All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0/ blind folio: 00
ALL IN ONE
CISSP
®
EXAM GUIDE Fourth Edition
FM.indd i
10/9/2007 1:59:58 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0 FM blind folio: ii
FM.indd ii
10/9/2007 2:00:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0 /FM blind folio: iii
ALL IN ONE
CISSP
®
EXAM GUIDE Fourth Edition
Shon Harris
New York • Chicago • San Francisco • Lisbon London • Madrid • Mexico City • Milan • New Delhi San Juan • Seoul • Singapore • Sydney • Toronto
FM.indd iii
10/9/2007 2:00:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0 blind folio iv
Cataloging-in-Publication Data is on file with the Library of Congress
McGraw-Hill books are available at special quantity discounts to use as premiums and sales promotions, or for use in corporate training programs. For more information, please write to the Director of Special Sales, Professional Publishing, McGraw-Hill, Two Penn Plaza, New York, NY 10121-2298. Or contact your local bookstore. CISSP® All-in-One Exam Guide, Fourth Edition Copyright © 2008 by The McGraw-Hill Companies. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. 1234567890 DOC DOC 01987 ISBN: Book p/n 978-0-07-149786-2 and CD p/n 978-0-07-149788-6 of Set 978-0-07-149787-9 MHID: Book p/n 0-07-149786-2 and CD p/n 0-07-149788-9 of Set 0-07-149787-0 Sponsoring Editor Timothy Green
Proofreader Paul Tyler
Editorial Supervisor Jody McKenzie
Indexer Claire Splan
Project Editor Laura Stone
Production Supervisor James Kussow
Acquisitions Coordinator Jennifer Housh
Composition Apollo Publishing Services
Technical Editors Joe Hoofnagle, Clement Dupuis
Art Director, Cover Jeff Weeks
Copy Editor Mike McGee
Cover Designer Pattie Lee
Information has been obtained by McGraw-Hill from sources believed to be reliable. However, because of the possibility of human or mechanical error by our sources, McGraw-Hill, or others, McGraw-Hill does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such information.
FM.indd iv
10/9/2007 2:00:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0 FM blind folio: v
I lost my greatest hero this year, George Fairbairn, my Grandpa. He taught me many things about life that cannot be taught in books, but only by example: integrity, unconditional love, humility, and the importance of internal strength and courage. I dedicate this book to my Grandpa and my wonderful and supportive family. I am truly lucky because most of my best friends are also my family members, especially my mother, Kathy Conlon, and my husband, David Harris.
FM.indd v
10/9/2007 2:00:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
ABOUT THE AUTHOR Shon Harris, CISSP, MCSE, is the president of Logical Security, a security consultant, a former engineer in the Air Force’s Information Warfare unit, an instructor, and an author. She has authored two best-selling CISSP books, was a contributing author to Hacker’s Challenge: Test Your Incident Response Skills Using 20 Scenarios, and a contributing author to Gray Hat Hacking: The Ethical Hacker’s Handbook (both published by McGraw-Hill). Shon has taught computer and information security to a wide range of clients, some of which have included RSA, Department of Defense, Department of Energy, National Security Agency (NSA), Bank of America, Defense Information Systems Agency (DISA), BMC, West Point, and many more. Shon was recognized as one of the top 25 women in the Information Security field by Information Security Magazine.
About the Technical Editors Joe Hoofnagle, CISSP, has more than 12 years’ experience in the field of Information Security, managing and developing security programs for private and commercial businesses. Currently, Joe is the Director of Information Security Services at Magellan Health Services. In this role, he has been tasked with the development of policy and its enforcement in the critical areas of computer and network forensics analysis, intrusion detection, regulatory assessment, and risk analysis. As a strategist, Joe created and maintains Magellan’s security risk modeling and computer forensic programs, which meet the stringent requirements of federal, state, legislative and business contracts. Joe has fostered collaborative working relationships with other organizations achieving best security practices. He is a member of the American Society for Industrial Security (ASIS) and the High Tech Crime Consortium (HTCC). Clement Dupuis, CD, CISSP, Security+, GCFW, GCIA, CEH, ECSA, CCSA, CCSE, is a Senior Security Instructor at Vigilar, where he also conducts security and penetration testing. He remains an internationally renowned security professional with vast experience as a trainer and security consultant for some of the world’s largest companies, having taught employees of Microsoft, the Canadian and U.S. DoD (Department of Defense), DISA (Defense Information System Agency), the Marine Corps, Bank of America, JP Morgan Chase, and many Top 100 companies. Prior to his work with Vigilar, Clement was employed by SANS as one of the three lead courseware developers for the Institute. All total, he has served over 20 years as a communication and IT specialist in the army signal corps for the Canadian Department of National Defense (DND).
FM.indd vi
10/9/2007 2:00:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CONTENTS AT A GLANCE Chapter 1
Becoming a CISSP
......................................
1
Chapter 2
Security Trends
.........................................
19
Chapter 3
Information Security and Risk Management
Chapter 4
Access Control
Chapter 5
Security Architecture and Design
Chapter 6
Physical and Environmental Security
Chapter 7
Telecommunications and Network Security
Chapter 8
Cryptography
Chapter 9
Business Continuity and Disaster Recovery
..................
53
........................................
155
..........................
279
........................
401
..................
481
..........................................
659
..................
Chapter 10
Legal, Regulations, Compliance, and Investigations
Chapter 11
769
.............
835
Application Security
.....................................
905
Chapter 12
Operations Security
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027
Appendix
About the CD-ROM
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109
Index
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113
vii
FM.indd vii
10/9/2007 2:00:06 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
FM.indd viii
10/9/2007 2:00:06 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CONTENTS Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxiii Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxv Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii
Chapter 1
Chapter 2
Chapter 3
Becoming a CISSP
......................................
1
Why Become a CISSP? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The CISSP Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CISSP: A Brief History ................................... How Do You Become a CISSP? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Recertification Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . What Does This Book Cover? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tips for Taking the CISSP Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . . How to Use This Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1 2 8 8 9 10 10 12 13 13 17
Security Trends
.........................................
19
How Security Became an Issue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Areas of Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Benign to Scary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Evidence of the Evolution of Hacking . . . . . . . . . . . . . . . . . . How Are Nations Affected? . . . . . . . . . . . . . . . . . . . . . . . . . . . How Are Companies Affected? . . . . . . . . . . . . . . . . . . . . . . . . The U.S. Government’s Actions . . . . . . . . . . . . . . . . . . . . . . . . So What Does This Mean to Us? . . . . . . . . . . . . . . . . . . . . . . . Hacking and Attacking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Internet and Web Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Two-Tier Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A Layered Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . An Architectural View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A Layer Missed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bringing the Layers Together ......................... Politics and Laws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Education . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
19 22 23 24 27 29 31 34 34 35 37 40 42 44 45 48 48 49 51 52
Information Security and Risk Management
..................
53
Security Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Management Responsibilities . . . . . . . . . . . . . . . . . . The Top-Down Approach to Security . . . . . . . . . . . . . . . . . . .
53 54 55
ix
FM.indd ix
10/9/2007 2:00:06 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
x Security Administration and Supporting Controls . . . . . . . . . . . . . Fundamental Principles of Security . . . . . . . . . . . . . . . . . . . . Security Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Through Obscurity . . . . . . . . . . . . . . . . . . . . . . . . . . Organizational Security Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Program Components . . . . . . . . . . . . . . . . . . . . . . . . Business Requirements: Private Industry vs. Military Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Information Risk Management ............................ Who Really Understands Risk Management? . . . . . . . . . . . . . Information Risk Management Policy . . . . . . . . . . . . . . . . . . The Risk Management Team . . . . . . . . . . . . . . . . . . . . . . . . . . Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Risk Analysis Team . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Value of Information and Assets . . . . . . . . . . . . . . . . . . . Costs That Make Up the Value . . . . . . . . . . . . . . . . . . . . . . . . Identifying Threats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Failure and Fault Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quantitative Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . Qualitative Risk Analysis ............................ Quantitative vs. Qualitative .......................... Protection Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Putting It Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Total Risk vs. Residual Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . Handling Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Policies, Standards, Baselines, Guidelines, and Procedures . . . . . . Security Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Standards ........................................ Baselines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Information Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Private Business vs. Military Classifications . . . . . . . . . . . . . . Classification Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Layers of Responsibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Who’s Involved? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Data Owner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Data Custodian . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The System Owner ................................. The Security Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . The Security Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Application Owner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Supervisor .................................... The Change Control Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . The Data Analyst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
FM.indd x
56 59 61 63 65 67 80 80 81 82 82 83 84 85 86 87 89 92 98 100 102 105 106 107 109 110 112 113 114 114 115 117 117 120 122 123 130 131 131 131 132 132 132 132 133
10/9/2007 2:00:07 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Contents
xi The Process Owner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Solution Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Product Line Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . The Auditor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Why So Many Roles? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Personnel ........................................ Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hiring Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Employee Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security-Awareness Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Different Types of Security-Awareness Training . . . . . . . . . . . Evaluating the Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Specialized Security Training . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 4
FM.indd xi
Access Control
133 133 134 134 134 134 135 135 136 138 138 139 140 141 142 143 144 147 152
........................................
155
Access Controls Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Availability ....................................... Integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Confidentiality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Identification, Authentication, Authorization, and Accountability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Identification and Authentication ..................... Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Access Control Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Discretionary Access Control . . . . . . . . . . . . . . . . . . . . . . . . . Mandatory Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . Role-Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . Access Control Techniques and Technologies . . . . . . . . . . . . . . . . . Rule-Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . Constrained User Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . Access Control Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Content-Dependent Access Control . . . . . . . . . . . . . . . . . . . . Context-Dependent Access Control . . . . . . . . . . . . . . . . . . . . Access Control Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Centralized Access Control Administration . . . . . . . . . . . . . . Decentralized Access Control Administration . . . . . . . . . . . . Access Control Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Access Control Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Administrative Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
155 156 157 157 157 158 160 195 210 211 212 214 217 217 218 219 221 221 222 223 230 230 231 232
10/9/2007 2:00:08 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0 blind folio: xii
CISSP All-in-One Exam Guide
xii
Chapter 5
FM.indd xii
Physical Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Technical Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Access Control Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preventive: Administrative ........................... Preventive: Physical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preventive: Technical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Accountability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Review of Audit Information ......................... Keystroke Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Protecting Audit Data and Log Information . . . . . . . . . . . . . . Access Control Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Unauthorized Disclosure of Information . . . . . . . . . . . . . . . . Access Control Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Intrusion Prevention Systems . . . . . . . . . . . . . . . . . . . . . . . . . A Few Threats to Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dictionary Attack .................................. Brute Force Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Spoofing at Logon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
233 234 237 239 239 240 243 245 245 246 246 247 250 250 260 263 263 264 265 269 269 272 276
Security Architecture and Design
..........................
279
Computer Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Central Processing Unit . . . . . . . . . . . . . . . . . . . . . . . . . . Multiprocessing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Operating System Architecture . . . . . . . . . . . . . . . . . . . . . . . . Process Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Memory Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Memory Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Virtual Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CPU Modes and Protection Rings . . . . . . . . . . . . . . . . . . . . . . Operating System Architecture . . . . . . . . . . . . . . . . . . . . . . . . Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Layering and Data Hiding . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Evolution of Terminology . . . . . . . . . . . . . . . . . . . . . . . . Virtual Machines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Additional Storage Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . Input/Output Device Management . . . . . . . . . . . . . . . . . . . . . System Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Defined Subsets of Subjects and Objects . . . . . . . . . . . . . . . . Trusted Computing Base . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Perimeter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Reference Monitor and Security Kernel . . . . . . . . . . . . . . . . .
281 281 286 287 294 296 298 306 308 310 312 312 314 315 317 317 321 322 323 326 327
10/9/2007 2:00:08 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Contents
xiii
Chapter 6
FM.indd xiii
Security Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Least Privilege . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Models ........................................ State Machine Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Bell-LaPadula Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Biba Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Clark-Wilson Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Information Flow Model . . . . . . . . . . . . . . . . . . . . . . . . . The Noninterference Model . . . . . . . . . . . . . . . . . . . . . . . . . . The Lattice Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Brewer and Nash Model . . . . . . . . . . . . . . . . . . . . . . . . . . The Graham-Denning Model . . . . . . . . . . . . . . . . . . . . . . . . . The Harrison-Ruzzo-Ulman Model . . . . . . . . . . . . . . . . . . . . . Security Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dedicated Security Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . System High-Security Mode . . . . . . . . . . . . . . . . . . . . . . . . . . Compartmented Security Mode . . . . . . . . . . . . . . . . . . . . . . . Multilevel Security Mode ............................ Trust and Assurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Systems Evaluation Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Why Put a Product Through Evaluation? . . . . . . . . . . . . . . . . The Orange Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Orange Book and the Rainbow Series . . . . . . . . . . . . . . . . . . . . The Red Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Information Technology Security Evaluation Criteria . . . . . . . . . . . Common Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Certification vs. Accreditation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Accreditation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Open vs. Closed Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Open Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Closed Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enterprise Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A Few Threats to Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maintenance Hooks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Time-of-Check/Time-of-Use Attacks . . . . . . . . . . . . . . . . . . . . Buffer Overflows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
328 329 330 331 333 336 338 342 345 346 348 349 349 351 352 352 352 353 355 356 356 357 361 362 364 366 369 370 371 372 372 372 373 382 382 383 384 388 389 392 397
Physical and Environmental Security
........................
401
Introduction to Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . The Planning Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Crime Prevention Through Environmental Design . . . . . . . . Designing a Physical Security Program . . . . . . . . . . . . . . . . .
401 404 409 414
10/9/2007 2:00:09 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
xiv Protecting Assets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Internal Support Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Electric Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Environmental Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ventilation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fire Prevention, Detection, and Suppression . . . . . . . . . . . . . Perimeter Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Facility Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Personnel Access Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . External Boundary Protection Mechanisms . . . . . . . . . . . . . . Intrusion Detection Systems . . . . . . . . . . . . . . . . . . . . . . . . . . Patrol Force and Guards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dogs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Auditing Physical Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Testing and Drills . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 7
FM.indd xiv
Telecommunications and Network Security
428 430 430 436 438 438 446 447 454 455 464 467 468 468 469 470 470 473 477
..................
481
Open Systems Interconnection Reference Model . . . . . . . . . . . . . . . Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Application Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Presentation Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Session Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transport Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Link Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Physical Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Functions and Protocols in the OSI Model . . . . . . . . . . . . . . Tying the Layers Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . TCP/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . TCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IP Addressing ..................................... IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Types of Transmission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Analog and Digital . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Asynchronous and Synchronous . . . . . . . . . . . . . . . . . . . . . . Broadband and Baseband . . . . . . . . . . . . . . . . . . . . . . . . . . . . LAN Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . LAN Media Access Technologies . . . . . . . . . . . . . . . . . . . . . . . Cabling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transmission Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Media Access Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . LAN Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
483 483 487 487 489 490 491 492 494 494 496 497 498 504 505 505 505 507 507 508 509 512 519 524 525 529
10/9/2007 2:00:10 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Contents
xv Routing Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Networking Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Repeaters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bridges .......................................... Routers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . PBXs ............................................ Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Honeypot ........................................ Network Segregation and Isolation . . . . . . . . . . . . . . . . . . . . Networking Services and Protocols . . . . . . . . . . . . . . . . . . . . . . . . . Network Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . Domain Name Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network Information System . . . . . . . . . . . . . . . . . . . . . . . . . Directory Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Lightweight Directory Access Protocol . . . . . . . . . . . . . . . . . . Network Address Translation . . . . . . . . . . . . . . . . . . . . . . . . . Intranets and Extranets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Metropolitan Area Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Wide Area Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Telecommunications Evolution . . . . . . . . . . . . . . . . . . . . . . . Dedicated Links ................................... WAN Technologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Remote Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dial-Up and RAS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ISDN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cable Modems .................................... VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Authentication Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . Remote Access Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . Wireless Technologies ................................... Wireless Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . WLAN Components ................................ Wireless Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . WAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i-Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mobile Phone Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . War Driving for WLANs ............................. Satellites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3G Wireless Communication . . . . . . . . . . . . . . . . . . . . . . . . . Rootkits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Spyware and Adware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Instant Messaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
FM.indd xv
532 536 536 536 539 541 545 547 548 566 567 567 567 569 573 575 576 577 579 581 583 583 586 589 603 603 604 606 606 608 614 616 618 618 621 623 635 636 637 639 640 641 643 645 645 647
10/9/2007 2:00:11 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
xvi Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 8
FM.indd xvi
Cryptography
647 651 655
..........................................
659
The History of Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cryptography Definitions and Concepts . . . . . . . . . . . . . . . . . . . . . Kerckhoff’s Principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Strength of the Cryptosystem . . . . . . . . . . . . . . . . . . . . . . Services of Cryptosystems . . . . . . . . . . . . . . . . . . . . . . . . . . . . One-Time Pad . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Running and Concealment Ciphers . . . . . . . . . . . . . . . . . . . . Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Governmental Involvement in Cryptography . . . . . . . . . . . . . . . . . . Types of Ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Substitution Ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Transposition Ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Methods of Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Symmetric vs. Asymmetric Algorithms . . . . . . . . . . . . . . . . . . Block and Stream Ciphers ........................... Hybrid Encryption Methods . . . . . . . . . . . . . . . . . . . . . . . . . . Types of Symmetric Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Encryption Standard . . . . . . . . . . . . . . . . . . . . . . . . . . . . Triple-DES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Advanced Encryption Standard . . . . . . . . . . . . . . . . . . . . International Data Encryption Algorithm . . . . . . . . . . . . . . . Blowfish ......................................... RC4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RC5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . RC6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Types of Asymmetric Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Diffie-Hellman Algorithm . . . . . . . . . . . . . . . . . . . . . . . . RSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . El Gamal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Elliptic Curve Cryptosystems . . . . . . . . . . . . . . . . . . . . . . . . . LUC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Knapsack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Zero Knowledge Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The One-Way Hash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Various Hashing Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . Attacks Against One-Way Hash Functions . . . . . . . . . . . . . . . Digital Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Digital Signature Standard . . . . . . . . . . . . . . . . . . . . . . . . . . . Public Key Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Certificate Authorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
660 665 668 668 669 671 673 674 675 676 677 677 679 679 685 689 695 696 703 703 704 704 705 705 705 706 706 708 711 712 713 713 713 713 714 718 721 722 725 725 726
10/9/2007 2:00:12 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Contents
xvii
Chapter 9
FM.indd xvii
Certificates ....................................... The Registration Authority . . . . . . . . . . . . . . . . . . . . . . . . . . . PKI Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Key Management ....................................... Key Management Principles . . . . . . . . . . . . . . . . . . . . . . . . . . Rules for Keys and Key Management . . . . . . . . . . . . . . . . . . . Link Encryption vs. End-to-End Encryption . . . . . . . . . . . . . . . . . . . E-mail Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Multipurpose Internet Mail Extension . . . . . . . . . . . . . . . . . . Privacy-Enhanced Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Message Security Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . Pretty Good Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quantum Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Internet Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Start with the Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cipher-Only Attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Known-Plaintext Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Chosen-Plaintext Attacks ............................ Chosen-Ciphertext Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . Differential Cryptanalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . Linear Cryptanalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Side-Channel Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Replay Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Algebraic Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Analytic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Statistical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
729 729 730 732 733 734 735 737 738 738 739 739 741 743 743 753 753 753 754 754 755 755 755 756 756 756 757 757 758 761 765
Business Continuity and Disaster Recovery
..................
769
Business Continuity and Disaster Recovery . . . . . . . . . . . . . . . . . . . Business Continuity Steps ........................... Making BCP Part of the Security Policy and Program . . . . . . Project Initiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Business Continuity Planning Requirements . . . . . . . . . . . . . . . . . . Business Impact Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . Preventive Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Recovery Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Business Process Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . Facility Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supply and Technology Recovery . . . . . . . . . . . . . . . . . . . . . . The End-User Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Backup Alternatives . . . . . . . . . . . . . . . . . . . . . . . . . . . .
770 772 774 776 778 778 786 786 788 789 795 800 801
10/9/2007 2:00:13 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
xviii Electronic Backup Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . Choosing a Software Backup Facility . . . . . . . . . . . . . . . . . . . Insurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Recovery and Restoration . . . . . . . . . . . . . . . . . . . . . . . . . . . . Developing Goals for the Plans . . . . . . . . . . . . . . . . . . . . . . . Implementing Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Testing and Revising the Plan . . . . . . . . . . . . . . . . . . . . . . . . . Maintaining the Plan ............................... Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 10
FM.indd xviii
Legal, Regulations, Compliance, and Investigations
803 806 808 809 814 815 816 821 825 825 827 832
.............
835
The Many Facets of Cyberlaw . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Crux of Computer Crime Laws . . . . . . . . . . . . . . . . . . . . . . . . . Complexities in Cybercrime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Electronic Assets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Evolution of Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Different Countries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Types of Laws ..................................... Intellectual Property Laws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Trade Secret . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Copyright ........................................ Trademark . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Patent ........................................... Internal Protection of Intellectual Property . . . . . . . . . . . . . . Software Piracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Laws, Directives, and Regulations . . . . . . . . . . . . . . . . . . . . . . Employee Privacy Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Liability and Its Ramifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Personal Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hacker Intrusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Investigations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Incident Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Incident Response Procedures . . . . . . . . . . . . . . . . . . . . . . . . Computer Forensics and Proper Collection of Evidence . . . . . . . . . International Organization on Computer Evidence . . . . . . . . Motive, Opportunity, and Means . . . . . . . . . . . . . . . . . . . . . . Incident Investigators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Forensics Investigation Process . . . . . . . . . . . . . . . . . . . . What Is Admissible in Court? . . . . . . . . . . . . . . . . . . . . . . . . . Surveillance, Search, and Seizure . . . . . . . . . . . . . . . . . . . . . . Interviewing and Interrogating . . . . . . . . . . . . . . . . . . . . . . . . A Few Different Attack Types .........................
836 836 839 842 842 844 846 849 849 850 850 851 851 852 853 854 859 861 864 865 866 866 869 872 873 874 875 876 880 883 884 884
10/9/2007 2:00:13 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Contents
xix
Chapter 11
FM.indd xix
Ethics ................................................ The Computer Ethics Institute . . . . . . . . . . . . . . . . . . . . . . . . The Internet Architecture Board . . . . . . . . . . . . . . . . . . . . . . . Corporate Ethics Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
888 889 890 891 892 892 895 900
Application Security
.....................................
905
Software’s Importance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Where Do We Place the Security? . . . . . . . . . . . . . . . . . . . . . . . . . . . Different Environments Demand Different Security . . . . . . . . . . . . Environment vs. Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Complexity of Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Types, Format, and Length . . . . . . . . . . . . . . . . . . . . . . . . . . . . Implementation and Default Issues . . . . . . . . . . . . . . . . . . . . . . . . . Failure States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database Management Software . . . . . . . . . . . . . . . . . . . . . . . Database Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database Programming Interfaces . . . . . . . . . . . . . . . . . . . . . Relational Database Components ..................... Integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Database Security Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Warehousing and Data Mining . . . . . . . . . . . . . . . . . . . System Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Management of Development . . . . . . . . . . . . . . . . . . . . . . . . . Life-Cycle Phases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Software Development Methods . . . . . . . . . . . . . . . . . . . . . . . Computer-Aided Software Engineering . . . . . . . . . . . . . . . . . Prototyping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Capability Maturity Model . . . . . . . . . . . . . . . . . . . . . . . . Software Escrow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Application Development Methodology . . . . . . . . . . . . . . . . . . . . . Object-Oriented Concepts ........................... Data Modeling .................................... Software Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cohesion and Coupling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Distributed Computing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . CORBA and ORBs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . COM and DCOM .................................. Enterprise JavaBeans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Object Linking and Embedding . . . . . . . . . . . . . . . . . . . . . . . Distributed Computing Environment ..................
905 906 908 908 909 910 910 912 912 913 914 919 921 924 927 932 935 936 936 950 952 953 953 955 957 957 958 966 966 967 967 969 969 971 972 973 974
10/9/2007 2:00:14 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
xx Expert Systems and Knowledge-Based Systems . . . . . . . . . . . . . . . . Artificial Neural Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Web Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Vandalism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Financial Fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Privileged Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Theft of Transaction Information . . . . . . . . . . . . . . . . . . . . . . Theft of Intellectual Property . . . . . . . . . . . . . . . . . . . . . . . . . Denial-of-Service (DoS) Attacks . . . . . . . . . . . . . . . . . . . . . . . Create a Quality Assurance Process . . . . . . . . . . . . . . . . . . . . Web Application Firewalls ........................... Intrusion Prevention Systems . . . . . . . . . . . . . . . . . . . . . . . . . Implement SYN Proxies on the Firewall . . . . . . . . . . . . . . . . . Specific Threats for Web Environments . . . . . . . . . . . . . . . . . Mobile Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Java . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ActiveX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Malicious Software (Malware) . . . . . . . . . . . . . . . . . . . . . . . . Antivirus Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Spam Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Anti-Malware Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Patch Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Step 1: Infrastructure ............................... Step 2: Research ................................... Step 3: Assess and Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Step 4: Mitigation (“Rollback”) ....................... Step 5: Deployment (“Rollout”) . . . . . . . . . . . . . . . . . . . . . . . Step 6: Validation, Reporting, and Logging . . . . . . . . . . . . . . Limitations to Patching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Best Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Anything Else? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter 12
Operations Security
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027
The Role of the Operations Department . . . . . . . . . . . . . . . . . . . . . Administrative Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security and Network Personnel . . . . . . . . . . . . . . . . . . . . . . . Accountability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Clipping Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Assurance Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Operational Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Unusual or Unexplained Occurrences . . . . . . . . . . . . . . . . . .
FM.indd xx
975 977 979 980 980 980 981 981 981 982 982 982 982 983 992 993 995 995 1001 1004 1005 1006 1007 1007 1007 1008 1008 1008 1008 1009 1009 1009 1014 1014 1018 1023 1028 1028 1031 1032 1033 1034 1034 1035
10/9/2007 2:00:15 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Contents
xxi Deviations from Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . Unscheduled Initial Program Loads (a.k.a. Rebooting) . . . . . Asset Identification and Management . . . . . . . . . . . . . . . . . . System Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Trusted Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Input and Output Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . System Hardening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Remote Access Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuration Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change Control Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change Control Documentation . . . . . . . . . . . . . . . . . . . . . . Media Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Leakage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Network and Resource Availability . . . . . . . . . . . . . . . . . . . . . . . . . . Mean Time Between Failures (MTBF) . . . . . . . . . . . . . . . . . . . Mean Time to Repair (MTTR) . . . . . . . . . . . . . . . . . . . . . . . . . Single Points of Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Contingency Planning .............................. Mainframes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E-mail Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . How E-mail Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Facsimile Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Hack and Attack Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . Vulnerability Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Penetration Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Wardialing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Other Vulnerability Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . Postmortem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Quick Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Appendix
About the CD-ROM
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109
Running the QuickTime Cryptography Video Sample . . . . . . . . . . . Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Installing Total Seminars’ Test Software . . . . . . . . . . . . . . . . . . . . . . Navigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Practice Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Final Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Minimum System Requirements for Total Seminars’ Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Index
FM.indd xxi
1035 1036 1036 1037 1038 1040 1042 1044 1045 1045 1047 1048 1054 1056 1057 1058 1058 1066 1070 1070 1072 1074 1076 1078 1087 1090 1094 1095 1097 1099 1099 1101 1106 1110 1111 1111 1111 1111 1111 1112 1112
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113
10/9/2007 2:00:16 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
FM.indd xxii
10/9/2007 2:00:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
FOREWORD As a teacher and practitioner of computer security, I am often asked the same two questions: How do I learn the basics of computer security to perform my job better, and how do I keep up to date on the latest security standards and practices? The first recorded computer “incident” occurred in 1958, and the first federally prosecuted crime identified as a computer crime involved modifying records at a bank in Minnesota in 1966. In the 1960s and 1970s, computer security was not taken seriously because it was not required as it is today. In 1976, the FBI established a four-week training course for its agents in the investigation of computer crime. Then, in 1977, Senator Ribicoff introduced the Federal Computer Systems Protection Act bill, which eventually became the Computer Fraud and Abuse Act of 1986. The publication 2600: The Hacker Quarterly was started in 1984 (containing instructions on how to hack telecommunication systems and computers), and additional sources of computer security where illegal copies of software were made available to everyone (warez sites) were established around the world. Toward the end of the 1980s, new security products were being introduced into the marketplace and organizations were beginning to realize they needed a “security specialist” to help augment their traditional information technology departments. I mention the FBI training course and the advent of the 2600 publication because these two events were crucial to starting the process of capturing and codifying a set of guidelines relating to the security practitioner. If you look at the history of how computer security has evolved into what it is today, one thing stands out above all else—the control of information. Nearly 20 years after the Morris worm wreaked havoc across the Internet, we still find ourselves struggling to patch systems, learn about the newest vendor vulnerabilities, and obtain information from our peers about potential trouble circulating through systems around the globe. For any IT professional, keeping up with new technologies, the associated business demands, and related security knowledge required to keep it all safe is a daunting task. The human element still remains the biggest single point of weakness when dealing with technological advancement and change. The good news is that progress has been made in the area of providing information related to industry best practices and knowledge sharing. The National Security Agency has certified 59 colleges and universities as “Centers of Excellence” for teaching information assurance, with many more programs being developed and certified every year. Training organizations now include security topics along with other sources of IT and business training. Information Sharing and Analysis Centers (ISACs) have been established for all sectors of our nation’s critical infrastructure. The National Institute of Standards and Technology (NIST) and other organizations are now publishing technical standards for security of the technologies that organizations rely upon to run their operations. Shon Harris started this book in 2001 as a way of codifying a set of best practices that could also be used to satisfy the requirements for passing the CISSP exam. She has accomplished both tasks extremely well, and as one of the best-selling security books, IT professionals are increasingly using this resource as a way of solidifying their security knowledge. I often use this book as an answer to the questions I described earlier, referring students to start with this book as a foundation upon which to build their security knowledge set. Obtaining the CISSP is a worthy objective, but absorbing the knowledge contained within this book will serve to make you a better security practitioner. —Jeff Recor Security Management Center of Excellence Deloitte & Touche LLP
FM.indd xxiii
xxiii
10/9/2007 2:00:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
xxiv Over the last 15 to 20 years, Information Security has evolved from an obscure discipline found primarily in government institutions, the military, and financial institutions to become a mainstream activity practiced in most large and medium-sized companies around the world. Numerous and varied factors have brought information security to where it is today. These include (partial list):
• The growth of the Internet. Ubiquitous connectivity, along with anonymity, have combined to make a complex and challenging threat landscape. • The continued migration of the vast majority of corporate information and intellectual property into digital forms, which are then connected to the Internet, has provided a target-rich environment for those wishing to acquire such data. • The rapid growth in outsourcing has required that companies completely rethink the controls that their outsourced service provider implement to protect their corporate data and intellectual property. • We have seen an explosion of laws such as Sarbanes Oxley (SOX), the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), California’s SB1386, the Family Educational Rights and Privacy Act (FERPA), the Communications Assistance for Law Enforcement Act (CALEA), the OECD privacy guidelines, and the Payment Card Industry Data Security Standards (PCI). • These laws, combined with the very public and embarrassing breaches that a number of companies and government entities have suffered (such as ChoicePoint, Bank of America, the Georgia DMV, CardSystems, La Salle Bank, ABN AMRO Mortgage Group, and The Department of Agriculture), have all contributed to the raising of this awareness. This raised awareness has translated into a huge demand for skilled and experienced Information Security professionals around the world. It is my belief that the demand will not slow down anytime soon, chiefly due to a constantly expanding and mutating threat landscape that is rooted in the continued migration of corporate data into electronic form, ubiquitous connectivity, and the highly competitive globalized marketplace. I am often asked by people wanting to get into information security, “How can I become an Information Security Practitioner? Where do I start?” I consistently tell them they need two things: a thorough education as to what information security is, and solid real-world experience. I also recommend they read and thoroughly understand Shon Harris’s CISSP study guide and then get their CISSP certification. This is a wonderful start that should be combined with both extensive experience and the practical application of the information security principals and concepts outlined in this book. I have had the honor of knowing Shon both as a friend and co-worker. She has an unbelievably detailed and thorough understanding of this subject, which is reflected in the current edition of the book you are currently holding. The pages herein have been updated and expanded since the first edition. It is superbly laid out and well written, making it easy to understand for anyone wanting to become an Information Security Practitioner. I would highly recommend this work to anyone. —Russell Walker Vice President, Information Security Warner Bros. Entertainment Inc.
FM.indd xxiv
10/9/2007 2:00:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
ACKNOWLEDGMENTS I would like to thank Sam Tomaino for attempting to explain to me many, many years ago how computers work; Dan Ferguson for never complaining about the bombardment of questions I continually fling his way and for fostering my never-ceasing curiosity and quest for knowledge; and my Dad (Tom Conlon), who had the courage to renew and deepen our relationship. Each one of these people has helped me write this book in more ways than they will ever know. For my fourth edition, I would also like to thank the following individuals for taking the time to help me with some new topics: • Dr. Burt Kaliski, vice president of research at RSA Security and chief scientist of its research center, RSA Laboratories. Thanks for answering those questions that no one else could! • Dr. Dorothy Denning, professor in the Department of Defense Analysis at the Naval Postgraduate School, for always graciously answering my questions whenever I’ve hit a wall. • David Miller, whose work ethic, loyalty, and friendship have inspired me. I am truly grateful to have David as part of my life. I never would have known the secret world of tequila without him. • Allen Harper, whose knowledge, impeccable character, and honesty have made him a role model to many in this world—including myself. He is an officer in the Marines who voluntarily went to war (Baghdad, Iraq) this year (2007); we are all thankful for your dedication and sacrifices for all of us, Allen. • Clement Dupuis, who, with his deep passion for sharing and helping others, has proven a wonderful and irreplaceable mentor and friend. • Jay Libove, whose knowledge base about information security is extremely advanced. I hope to grow up and be as smart as he is one day. • Mike Lester, who is probably the smartest and funniest guy I have ever known, and really comes through when I need him the most. Thanks a lot, Sparky. We will work on getting you to understand the months of the year and where static electricity comes from. • Joe Hoofnagle, who has always been there when I needed help, is a good friend, and is the only person with whom I play Twister through e-mail. • Jason Radar, who helped me when I called upon him as the deadlines for this monster of a book loomed over me. I am looking forward to you being a new member of our Logical Security team! • Tom and Kathy Conlon, my parents. Without their love and support, my life would be a whole lot different today. Most especially, I would like to thank my husband, David Harris, for his continual support and love. Without his steadfast confidence in me, I would not have been able to accomplish half the things I have taken on in my life. xxv
FM.indd xxv
10/9/2007 2:00:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
FM.indd xxvi
10/9/2007 2:00:18 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
INTRODUCTION Computer, information, and physical security are becoming more important at an exponential rate since the continual increase in computer crimes. Over the last few years, the necessity for computer and information security has grown rapidly as web sites have been defaced, Denial-of-Service attacks have increased, credit card information has been stolen, publicly available hacking tools have become more sophisticated, and today’s viruses and worms cause more damage than ever before. Companies have had to spend millions of dollars to clean up the effects of these issues and millions of dollars more to secure their perimeter and internal networks with equipment, software, consultants, and education. But after September 11, 2001, the necessity and urgency for this type of security has taken on a new paradigm. It is slowly becoming apparent that governments, nations, and societies are vulnerable to many different types of attacks that can happen over the network wire and airwaves. Societies depend heavily on all types of computing power and functionality, mostly provided by the public and private sectors. This means that although governments are responsible for protecting their citizens, it is becoming apparent that the citizens and their businesses must become more secure to protect the nation as a whole. This type of protection can really only begin through proper education and understanding, and must continue with the dedicated execution of this knowledge. This book is written to provide a foundation of the many different areas that make up effective security. We need to understand all of the threats and dangers we are vulnerable to and the steps that must be taken to mitigate these vulnerabilities.
xxvii
FM.indd xxvii
10/9/2007 2:00:18 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CHAPTER
Becoming a CISSP
1
This chapter presents the following • The definition of a CISSP • Reasons to become a CISSP • What the CISSP exam entails • The Common Body of Knowledge and what it contains • The history of (ISC)2 and the CISSP exam • Recertification requirements • An assessment test to gauge your current knowledge of security
This book is intended not only to provide you with the necessary information to help you gain a CISSP certification, but also to welcome you into the exciting and challenging world of security. The Certified Information Systems Security Professional (CISSP) exam covers ten different subjects, more commonly referred to as domains. The subject matter of each domain can easily be seen as its own area of study, and in many cases individuals work exclusively in these fields as experts. For many of these subjects, extensive resources can be consulted and referenced to become an expert in that area. Because of this, a common misconception is that the only way to succeed at the CISSP exam is to immerse yourself in a massive stack of texts and study materials. Fortunately, an easier approach exists. By using this fourth edition of the CISSP All-in-One Exam Guide, you can successfully complete and pass the CISSP exam and achieve your CISSP certification. The goal of this book is to combine into a single resource all the information you need to pass the CISSP exam. This book should also serve as a useful reference tool long after you’ve achieved your CISSP certification.
Why Become a CISSP? As our world changes, the need for improvements in security and technology continues to grow. Security was once a hot issue only in the field of technology, but now it is becoming more and more a part of our everyday lives. Security is a concern of every organization, government agency, corporation, and military unit. Ten years ago computer and information security was an obscure field that only concerned a few people. Because the risks were essentially low, few were interested in security expertise. Ethical hacking
1
ch01.indd 1
10/5/2007 11:30:12 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
2 and vulnerability assessments required great talent and knowledge and thus were not a common practice. Things have changed, however, and today corporations and other organizations are desperate to recruit talented and experienced security professionals to help protect the resources they depend on to run their businesses and to remain competitive. With a CISSP certification, you will be seen as a security professional of proven ability who has successfully met a predefined standard of knowledge and experience that is well understood and respected throughout the industry. By keeping this certification current, you will demonstrate your dedication to staying abreast of security developments. Reasons for attaining a CISSP certification: • To meet the growing demand and to thrive in an ever-expanding field • To broaden your current knowledge of security concepts and practices • To bring security expertise to your current occupation • To become more marketable in a competitive workforce • To show a dedication to the security discipline • To increase your salary and be eligible for more employment opportunities The CISSP certification helps companies identify which individuals have the ability, knowledge, and experience necessary to implement solid security practices, perform risk analysis, identify necessary countermeasures, and help the organization as a whole protect its facility, network, systems, and information. The CISSP certification also shows potential employers you have achieved a level of proficiency and expertise in skill sets and knowledge required by the security industry. The increasing importance placed on security in corporate success will only continue in the future, leading to even greater demands for highly skilled security professionals. CISSP certification shows that a respected third-party organization has recognized an individual’s technical and theoretical knowledge and expertise, and distinguishes that individual from those who lack this level of knowledge. Understanding and implementing security practices is an essential part of being a good network administrator, programmer, or engineer. Job descriptions that do not specifically target security professionals still often require that a potential candidate have a good understanding of security concepts as well as how to implement them. Due to staff size and budget restraints, many organizations can’t afford separate network and security staffs. But this doesn’t mean they don’t believe security is vital to their organization. Thus, they often try to combine knowledge of technology and security into a single role. With a CISSP designation, you can put yourself head and shoulders above other individuals in this regard.
The CISSP Exam To meet the certification requirements of a CISSP, you must have one of the following: • Five years professional experience in two (or more) of the domains within the Common Body of Knowledge (CBK).
ch01.indd 2
10/5/2007 11:30:19 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
3 • Four years experience in two (or more) of the ten domains, and a four-year college degree or master’s degree in information security from a National Center of Excellence. • At least three years experience in two (or more) of the ten domains and a fouryear college degree or master’s degree in information security from a National Center of Excellence, plus a professional certification from the following list (candidates are permitted a waiver of one year of experience for any credential on the approved credentials list): • CERT Certified Computer Security Incident Handler (CSIH) • Certified Business Continuity Planner (CBCP) • Certified Computer Crime Investigator (Advanced) (CCCI) • Certified Computer Crime Prosecutor • Certified Computer Examiner (CCE) • Certified Fraud Examiner (CFE) • Certified Information Systems Auditor (CISA) • Certified Information Security Manager (CISM) • Certified Internal Auditor (CIA) • Certified Protection Professional (CPP) • Certified Wireless Security Professional (CWSP) • CompTIA Security+ • Computer Forensic Computer Examiner (CFCE) • GIAC Security Essentials Certification (GSEC) • GIAC Certified Firewall Analyst (GCFW) • GIAC Certified Intrusion Analyst (GCIA) • GIAC Certified Incident Handler (GCIH) • GIAC Certified Windows Security Administrator (GCWN) • GIAC Certified UNIX Security Administrator (GCUX) • GIAC Certified Forensic Analyst (GCFA) • GIAC Information Security Officer (GISO) • GIAC IT Security Audit Essentials (GSAE) • GIAC Security Expert (GSE) • GIAC Certified ISO-17799 Specialist (G7799) • GIAC Security Leadership Certification (GSLC) • GIAC Systems and Network Auditor (GSNA) • GIAC Certified Security Consultant (GCSC) • Microsoft Certified Systems Administrator (MCSA) • Microsoft Certified Systems Engineer (MCSE) • Master Business Continuity Planner (MBCP) • System Security Certified Practitioner (SSCP)
ch01.indd 3
10/5/2007 11:30:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
4 Consult www.isc2.org for a complete list and description of requirements for your CISSP certification. Because the CISSP exam covers the ten domains making up the CISSP CBK, it is often described as being “an inch deep and a mile wide,” a reference to the fact that many questions on the exam are not very detailed in nature and do not require you to be an expert in every subject. However, the questions do require you be familiar with many different security subjects. The CISSP exam is comprised of 250 multiple-choice questions, and you have six hours to complete it. The questions are pulled from a much larger question bank to ensure the exam is as unique as possible for each entrant. In addition, the test bank constantly changes and evolves to more accurately reflect the real world of security. The exam questions are continually rotated and replaced in the bank as necessary. Each question has four answer choices, only one of which is correct. Only 225 questions are graded, while 25 are used for research purposes. The 25 research questions are integrated into the exam, so you won’t know which go towards your final grade. To pass the exam, you need a minimum raw score of 700 points out of 1,000. Questions are weighted based on their difficulty; not all questions are worth the same number of points. The exam is not product- or vendor-oriented, meaning no questions will be specific to certain products or vendors (for instance, Windows 2000, Unix, or Cisco). Instead, you will be tested on the security models and methodologies used by these types of systems. (ISC)2 has also added scenario-based questions to the CISSP exam. These questions present a short scenario to the test taker rather than asking the test taker to identify terms and/or concepts. A scenario-based question would be worded something like “John returned from lunch and found that the company’s IDS indicated that a critical server has had continuous ICMP traffic sent to it for over 45 minutes, which is taking up 85% of the server’s CPU resource. What does John need to do at this point?” The goal of the scenario-based questions is to ensure that test takers not only know and understand the concepts within the CBK, but also can apply this knowledge to reallife situations. This is more practical because in the real world, you won’t be challenged by having someone come up to you and ask, “What is the definition of collusion?” You need to know how to detect and prevent collusion from taking place, in addition to knowing the definition of the term. NOTE Hundreds of scenario-based questions have been added to the CD-ROM in the back of this book to help you prepare for this exam.
The International Information Systems Security Certification Consortium (ISC)2 process for earning credentials will change as of October 2007. In order to obtain this credential, candidates for any of the (ISC)2 credential will be required to obtain an endorsement of their candidature exclusively from an (ISC)2 certified professional in good standing. The professional endorsing the candidate can hold any (ISC)2 certification, such as the CISSP, SSCP, or CAP. This sponsor will vouch for your years of experience.
ch01.indd 4
10/5/2007 11:30:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
5 After passing the exam, you will be asked to supply documentation, supported by a sponsor, proving that you indeed have this type of experience. The sponsor must sign a document vouching for the security experience you are submitting. So, make sure you have this sponsor lined up prior to registering for the exam and providing payment. You don’t want to pay for and pass the exam, only to find you can’t find a sponsor for the final step needed to achieve your certification. The reason behind the sponsorship requirement is to insure that those who achieve the certification have real-world experience to offer companies. Book knowledge is extremely important for understanding theory, concepts, standards, and regulations, but it can never replace hands-on experience. Proving you have practical experience supports the relevance of the certification. Afterward, a small sample group of individuals selected at random will be audited after passing the exam. The audit consists mainly of individuals from (ISC)2 calling on the candidates’ stated sponsors and contacts to verify that the test taker’s related experience is true. What makes this exam challenging is that most candidates, although they work in the security field, are not necessarily familiar with all ten CBK domains. If a security professional is considered an expert in vulnerability testing or application security, for example, she may not be familiar with physical security, cryptography, or security practices. Thus, studying for this exam will broaden your knowledge of the security field. The exam questions address the ten CBK security domains, which are described in Table 1-1. (ISC)2 attempts to keep up with changes in technology and methodologies brought to the security field by adding a large number of new questions to the test question bank each year. These questions are based on current technologies, practices, approaches, and standards. For example, the CISSP exam given in 1998 did not have questions pertaining to wireless security, but present and future exams will. Other examples of material not on past exams include security governance, instant messaging, phishing, botnets, VoIP, and spam. Though these subjects weren’t issues in the past, they are now—and in the case of botnets, VoIP, and spam, they will be in the future. The test is based on internationally accepted information security standards and practices. If you look at the (ISC)2 web site for test dates and locations, you may find, for example, that the same test is offered this Tuesday in California and next Wednesday in Saudi Arabia. If you do not pass the exam, you have the option of retaking it as soon as you like. (ISC)2 used to subject individuals to a waiting period before they could retake the exam, but this rule has been removed. (ISC)2 keeps track of which exam version you were given on your first attempt and ensures you receive a different version for any retakes. (ISC)2 also provides a report to a CISSP candidate who did not pass the exam, detailing the areas where the candidate was weakest. Though you could retake the exam soon afterward, it’s wise to devote additional time to these weak areas to improve your score on the retest.
ch01.indd 5
10/5/2007 11:30:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
6 Domain
Description
Access Control
This domain examines mechanisms and methods used to enable administrators and managers to control what subjects can access, the extent of their capabilities after authorization and authentication, and the auditing and monitoring of these activities. Some of the topics covered include: • Access control security models • Identification and authentication technologies and techniques • Access control administration • Single sign-on technologies • Attack methods
Telecommunications and Network Security
This domain examines internal, external, public, and private communication systems; networking structures; devices; protocols; and remote access and administration. Some of the topics covered include: • OSI model and layers • Local area network (LAN), metropolitan area network (MAN), and wide area network (WAN) technologies • Internet, intranet, and extranet issues • Virtual private networks (VPNs), firewalls, routers, bridges, and repeaters • Network topologies and cabling • Attack methods
Information Security and Risk Management
This domain examines the identification of company assets, the proper way to determine the necessary level of protection required, and what type of budget to develop for security implementations, with the goal of reducing threats and monetary loss. Some of the topics covered include: • Data classification • Policies, procedures, standards, and guidelines • Risk assessment and management • Personnel security, training, and awareness
Application Security
This domain examines the security components within operating systems and applications and how to best develop and measure their effectiveness. It looks at software life cycles, change control, and application security. Some of the topics covered include: • Data warehousing and data mining • Various development practices and their risks • Software components and vulnerabilities • Malicious code
Cryptography
This domain examines methods and techniques for disguising data for protection purposes. This involves cryptography techniques, approaches, and technologies. Some of the topics covered include: • Symmetric versus asymmetric algorithms and uses • Public key infrastructure (PKI) and hashing functions • Encryption protocols and implementation • Attack methods
Table 1-1 Security Domains That Make Up the CISSP CBK
ch01.indd 6
10/5/2007 11:30:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
7 Domain
Description
Security Architecture and Design
This domain examines concepts, principles, and standards for designing and implementing secure applications, operating systems, and systems. This covers international security measurement standards and their meaning for different types of platforms. Some of the topics covered include: • Operating states, kernel functions, and memory mapping • Enterprise architecture • Security models, architectures, and evaluations • Evaluation criteria: Trusted Computer Security Evaluation Criteria (TCSEC), Information Technology Security Evaluation Criteria (ITSEC), and Common Criteria • Common flaws in applications and systems • Certification and accreditation
Operations Security
This domain examines controls over personnel, hardware, systems, and auditing and monitoring techniques. It also covers possible abuse channels and how to recognize and address them. Some of the topics covered include: • Administrative responsibilities pertaining to personnel and job functions • Maintenance concepts of antivirus, training, auditing, and resource protection activities • Preventive, detective, corrective, and recovery controls • Standards, compliance, and due care concepts • Security and fault tolerance technologies
Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP)
This domain examines the preservation of business activities when faced with disruptions or disasters. It involves the identification of real risks, proper risk assessment, and countermeasure implementation. Some of the topics covered include: • Business resource identification and value assignment • Business impact analysis and prediction of possible losses • Unit priorities and crisis management • Plan development, implementation, and maintenance
Legal Regulations, Compliance, and Investigation
This domain examines computer crimes, laws, and regulations. It includes techniques for investigating a crime, gathering evidence, and handling procedures. It also covers how to develop and implement an incident-handling program. Some of the topics covered include: • Types of laws, regulations, and crimes • Licensing and software piracy • Export and import laws and issues • Evidence types and admissibility into court • Incident handling
Physical (Environmental) Security
This domain examines threats, risks, and countermeasures to protect facilities, hardware, data, media, and personnel. This involves facility selection, authorized entry methods, and environmental and safety procedures. Some of the topics covered include: • Restricted areas, authorization methods, and controls • Motion detectors, sensors, and alarms • Intrusion detection • Fire detection, prevention, and suppression • Fencing, security guards, and security badge types
Table 1-1 Security Domains That Make Up the CISSP CBK (continued)
ch01.indd 7
10/5/2007 11:30:21 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
8
CISSP: A Brief History Historically, the field of computer and information security has not been a structured and disciplined profession; rather, the field has lacked many well-defined professional objectives and thus has often been misperceived. In the mid-1980s, members of the computer security profession recognized they needed a certification program that would give their profession structure and provide ways for computer security professionals to demonstrate competence and present evidence of their qualifications. Establishing such a program would help the credibility of the computer and information security profession as a whole and the individuals who make up the profession. In November 1988, the Special Interest Group for Computer Security (SIG-CS) of the Data Processing Management Association (DPMA) brought together several organizations interested in forming a security certification program. They included the Information Systems Security Association (ISSA), the Canadian Information Processing Society (CIPS), the Computer Security Institute (CSI), Idaho State University, and several U.S. and Canadian government agencies. As a voluntary joint effort, these organizations developed the necessary components to offer a full-fledged security certification for interested professionals. (ISC)2 was formed in mid-1989 as a nonprofit corporation to develop a security certification program for information systems security practitioners. The certification was designed to measure professional competence and help companies in their selection of security professionals and personnel. (ISC)2 was established in North America, but quickly gained international acceptance and now offers testing capabilities all over the world. Because security is such a broad and diversified field in the technology and business world, the original consortium decided on an information systems security CBK composed of ten domains that pertain to every part of computer, network, business, and information security. In addition, because technology continues to rapidly evolve, staying up-to-date on security trends, technology, and business developments is required to maintain the CISSP certification. The group also developed a Code of Ethics, test specifications, a draft study guide, and the exam itself. CAUTION There has been a lot of controversy in the industry about (ISC)2, a nonprofit organization that maintains the CISSP certification and provides training for this certification. Many times the (ISC)2 Institute has told companies that they cannot have an exam set up for them unless the companies take the (ISC)2 Institute’s training. This is a conflict of interest that has been brought up for years, and civil suits have been threatened. Feel comfortable to take training that best fits your needs, whether it be through the (ISC)2 Institute or another vendor.
How Do You Become a CISSP? To become a CISSP, start at www.isc2.org, where you will find an exam registration form you must fill out and send to (ISC)2. You will be asked to provide your security work history, as well as documents for the necessary educational requirements. Gradu-
ch01.indd 8
10/5/2007 11:30:21 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
9 ating with a master’s degree from one of the listed National Centers of Excellence and having two years of experience will also qualify you. These National Centers of Excellence are listed at www.nsa.gov/ia/academia/CAE.pdf, and the list of colleges and universities is growing. You will also be asked to read the (ISC)2 Code of Ethics and sign a form, indicating that you understand these requirements and promise to abide by them. You then provide payment along with the registration form, where you indicate your preference as to the exam location. The numerous testing sites and dates can be found at www.isc2.org. Although (ISC)2 used to count cumulative years of job experience toward the requirements to take the CISSP exam, it has tightened its criteria; test takers must carry out full-time employment in two or more domains. People often think they do not have the necessary experience required to take this exam when they actually do, so it’s always a good idea to contact (ISC)2 directly to find out if you are indeed qualified before throwing this chance away.
Recertification Requirements The CISSP certification is valid for three years. To recertify for an additional three years, you can opt to retake the CISSP exam (many other certifications, such as Microsoft and Cisco certifications, require retaking the exam) or you can do what most CISSPs elect to do. They earn continuing professional education (CPE) credits that qualify them for exam-free recertification. Taking this approach for CISSP certification requires that you earn 120 CPE credits over a three-year recertification period. Thus, you can either rest and retake the exam, or gain the 120 CPE credits in the three-year period. Many types of activities can qualify for CPE credits, and they are broken down into two main sections: activities directly related to information security, and educational activities that either enhance a security professional’s skill and knowledge or enhance the knowledge of others through provision of training and education. The following items can be counted towards CPE credits, helping keep your CISSP certification current: • Attending a vendor training course or presentation • Attending a security conference • Taking a university or college security course related to one of the CBK domains • Publishing a security article or book • Providing security training • Serving on the board of a professional security organization or attending its meetings • Engaging in self-study • Reading a security book • Working as a volunteer, such as proctoring (helping to monitor) a CISSP exam • Creating and submitting questions for future exams
ch01.indd 9
10/5/2007 11:30:21 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
10 This is by no means a complete list. Other activities may also count as CPE credits. Therefore, it’s best to contact (ISC)2 to see which ones are valid. (ISC)2 also offers an Associate CISSP program, which is available to those individuals who have developed a level of competence in a certain security area. They may be capable of passing the CISSP exam, but lack the years of practical work experience required to be fully accredited. In addition, to become an Associate they must also subscribe to the (ISC)2 Code of Ethics, as well as keep themselves in good standing with the (ISC)2. So how can you benefit by becoming an Associate of (ISC)2? Well, it’s a good way to align yourself in the security community when you have yet to gain enough realworld experience. Employers will know that you recognize the need to prove yourself, and are obviously taking the appropriate steps to set yourself apart from others who are uncertified. It also provides you with the backing and resources of the (ISC)2. You may not have a CISSP certification, but you will still be recognized as a member of the CISSP community and will know the secret handshake.
What Does This Book Cover? This book covers everything you need to know to become an (ISC)2-certified CISSP. It teaches you the hows and whys behind corporations’ development and implementation of policies, procedures, guidelines, and standards. It covers network, application, and system vulnerabilities, what exploits them, and how to counter these threats. The book explains physical security, operational security, and why systems implement the security mechanisms they do. It also reviews the U.S. and international security criteria and evaluations performed on systems for assurance ratings, what these criteria mean, and why they are used. This book also explains the legal and liability issues that surround computer systems and the data they hold, including such subjects as computer crimes, forensics, and what should be done to properly prepare computer evidence associated with these topics for court. While this book is mainly intended to be used as a study guide for the CISSP exam, it is also a handy reference guide for use after your certification.
Tips for Taking the CISSP Exam The test is 250 questions and you are given up to six hours to take it. The exams are monitored by CISSP proctors. Depending on the facility that hosts the test, you may or may not be allowed to bring in food or drink, so plan ahead and eat a good breakfast full of protein and fructose for brainpower. Proctors who allow food and beverages typically require they be in a closable container and generally do not allow you to place them on the desk or table where you could spill anything on your exam paper. Some proctors let you keep your goodies in a bag next to you on the floor, or at the front or back of the room. Proctors may inspect the contents of any and all articles entering the test room. Restroom breaks are usually limited to allowing only one person to leave at a time, so drinking 15 cups of coffee right before the exam might not be the best idea. The exam questions are not long, which is good because the test has so many questions, but this also means you get less information about what the questions are really asking for. Make sure to read the question and its answers thoroughly instead of read-
ch01.indd 10
10/5/2007 11:30:22 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
11 ing a few words and immediately assuming you know what the question is asking. Some of the answer choices may have only subtle differences, so be patient and devote time to reading through the question more than once. Like most tests, it is best to go through the questions and answer those you know immediately, and then go back to the ones causing you difficulty. The CISSP exam is not computerized, so you will receive a piece of paper with bubbles to fill in, and one of several colored exam booklets containing the questions. I bring this up because if you scribble outside the lines on the answer sheet, the machine that reads your answers may count a correct answer as wrong. So, I suggest you go through each question and mark the right answer in the booklet with the questions. Repeat this process until you have completed your selections. At such time, go through the questions again and fill in the bubbles. This approach leads to less erasing and fewer potential problems with the scoring machine. You are allowed to write and scribble on your question exam booklet any way you choose. You will turn it in at the end of your exam with your answer sheet, but only answers on the answer sheet will be counted, so make sure you transfer all your answers to the answer sheet. Other certification exams may be taking place simultaneously in the same room, such as exams for certification as an SSCP (Systems Security Certified Professional), ISSAP or ISSMP (Architecture and Management concentrations, respectively), or ISSEP (Engineering concentration), which is the (ISC)2/NSA government certification. These other exams vary in length and duration, so don’t feel rushed if you see others leaving the room early; they may be taking a shorter exam. Another certification offered by (ISC)2 is the Certification and Accreditation Professional (CAP). This was developed by (ISC)2 along with the U.S. Department of State’s Office of Information Assurance to create what they consider the gold standard in the field of global information security. This CAP credential is intended to be an objective gauge of the level of knowledge, abilities, and skills personnel will be required to have to participate in the Certification and Accreditation process. This deals directly with those professionals tasked with the creation and assessment of a formalized process to be used in determining risk and establishing security requirements. They will also be tasked with ensuring that information systems possess the security necessary to counter potential risks. This is another certification that, depending upon your field, can not only benefit your career but the organization you work for as well. When finished, don’t immediately turn in your exam. You have six hours, so don’t squander it just because you might be tired or anxious. Use the time wisely. Take an extra couple of minutes to make sure you answered every question, and that you did not accidentally fill in two bubbles for the same question. Unfortunately, exam results take some time to be returned. (ISC)2 states it can take up to six weeks to get your results to you, but on average it takes between four days to two weeks to receive your results through e-mail and/or the mail. If you passed the exam, the results sent to you will not contain your score—you will only know that you passed. Candidates who do not pass the test are always provided with a score, however. Thus, they know exactly which areas to focus more attention on for the next exam. The domains are listed on this notification with a ranking of weakest to strongest. If you do not pass the exam, it’s best to remember that many smart and talented security professionals didn’t pass on their first try either, chiefly because the test covers such a broad range of topics.
ch01.indd 11
10/5/2007 11:30:22 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
12 One of the most commonly heard complaints is about the exam itself. The questions are not longwinded, like many Microsoft tests, but at times it is difficult to decipher between two answers that seem to say the same thing. Although (ISC)2 has been removing the use of negatives, such as “not,” “except for,” and so on, they do still appear on the exam. This is slowly being remedied and should become less and less of an issue over time. Note that (ISC)2 is currently introducing scenario-based questions, which will be long and will expect you to understand concepts in more than one domain to properly answer the question. Another complaint heard about the test is that some questions seem a bit subjective. For example, whereas it might be easy to answer a technical question that asks for the exact mechanism used in Secure Sockets Layer (SSL) that protects against man-inthe-middle attacks, it’s not quite as easy to answer a question that asks whether an eight-foot perimeter fence provides low, medium, or high security. This complaint is mentioned here not to criticize (ISC)2 and the test writers, but to instead help you better prepare for the test. This book covers all the necessary material for the test and contains many questions and self-practice tests. Most of the questions are formatted in such a way as to better prepare you for what you will encounter on the actual test. So make sure to read all the material in the book, and pay close attention to the questions and their formats. Even if you know the subject well, you may still get some answers wrong—it is just part of learning how to actually take tests. Familiarize yourself with industry standards and expand your technical knowledge and methodology outside the boundaries of what you use today. I cannot stress enough that just because you are the top dog in your particular field, it doesn’t mean you are properly prepared for each and every domain the exam covers. Take the assessment test in this chapter to gauge where you stand, and be ready to read a lot of material you have not read before.
How to Use This Book Much effort has gone into putting all the necessary information into this book. Now it’s up to you to study and understand the material and its various concepts. To best benefit from this book, you might want to use the following study method: 1. Study each chapter carefully and make sure you understand each concept presented. Many concepts must be fully understood, and glossing over a couple here and there could be detrimental to you in the end. The CISSP CBK contains over 300 individual topics, so take the time needed to understand them all. 2. Make sure to study and answer all of the questions at the end of the chapter, as well as those on the CD-ROM included with the book. If any questions confuse you, go back and study those sections again. Remember, some of the questions on the actual exam are a bit confusing because they do not seem straightforward. I have attempted to draft several questions in the same manner to prepare you for the exam. So do not ignore the confusing questions, thinking they’re not well worded. Instead, pay even closer attention to them because they are there for a reason.
ch01.indd 12
10/5/2007 11:30:22 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
13 3. If you are not familiar with specific topics, such as firewalls, laws, physical security, or protocol functionality, use other sources of information (books, articles, and so on) to attain a more in-depth understanding of those subjects. Don’t just rely on what you think you need to know to pass the CISSP exam. 4. After reading this book, study the questions and answers, and take the practice tests. Then review the (ISC)2 study guide and make sure you are comfortable with each bullet item presented. If you are not comfortable with some items, revisit those chapters. If you have taken other certification exams—such as Cisco, Novell, or Microsoft— you might be used to having to memorize details and configuration parameters. But remember, the CISSP test is “an inch deep and a mile wide,” so make sure you understand the concepts of each subject before trying to memorize the small, specific details.
References • Logical Security www.logicalsecurity.com/resources/resources_quiz_select.html • (ISC)2 www.isc2.org • CISSP.com Web Portal www.cissps.com • CISSP and SSCP Open Study Guides www.cccure.org
Questions To get a better feel for your level of expertise and your current level of readiness for the CISSP exam, run through the following questions: 1. What is derived from a passphrase? A. A personal password B. A virtual password C. A user ID D. A valid password 2. Which access control method is user-directed? A. Nondiscretionary B. Mandatory C. Identity-based D. Discretionary 3. Which item is not part of a Kerberos authentication implementation? A. A message authentication code B. A ticket-granting ticket C. Authentication service D. Users, programs, and services
ch01.indd 13
10/5/2007 11:30:22 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
14 4. If a company has a high turnover rate, which access control structure is best? A. Role-based B. Decentralized C. Rule-based D. Discretionary 5. In discretionary access control, who/what has delegation authority to grant access to data? A. A user B. A security officer C. A security policy D. An owner 6. Remote access security using a token one-time password generation is an example of which of the following? A. Something you have B. Something you know C. Something you are D. Two-factor authentication 7. What is a crossover error rate (CER)? A. A rating used to rank a biometric system B. The number of Type I errors C. The number of Type II errors D. The number reached when Type I errors exceed the number of Type II errors 8. What does a retina scan biometric system do? A. Examines the pattern, color, and shading of the area around the cornea B. Examines the patterns and records the similarities between an individual’s eyes C. Examines the pattern of blood vessels at the back of the eye D. Examines the geometry of the eyeball 9. If you are using a synchronous token device, what does this mean? A. The device synchronizes with the authentication service by using internal time or events. B. The device synchronizes with the user’s workstation to ensure the credentials it sends to the authentication service are correct. C. The device synchronizes with the token to ensure the timestamp is valid and correct. D. The device synchronizes by using a challenge-response method with the authentication service.
ch01.indd 14
10/5/2007 11:30:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
15 10. What is a clipping level? A. The threshold for an activity B. The size of a control zone C. Explicit rules of authorization D. A physical security mechanism 11. Which intrusion detection system would monitor user and network behavior? A. Statistical B. Signature-based C. Static D. Host-based 12. When should a Class C fire extinguisher be used instead of a Class A? A. When electrical equipment is on fire B. When wood and paper are on fire C. When a combustible liquid is on fire D. When the fire is in an open area 13. How does Halon suppress fires? A. It reduces the fire’s fuel intake. B. It reduces the temperature of the area. C. It disrupts the chemical reactions of a fire. D. It reduces the oxygen in the area. 14. What is the problem with high humidity in a data processing environment? A. Corrosion B. Fault tolerance C. Static electricity D. Contaminants 15. What is the definition of a power fault? A. Prolonged loss of power B. Momentary low voltage C. Prolonged high voltage D. Momentary power outage 16. Who has the primary responsibility of determining the classification level for information? A. The functional manager B. Middle management C. The owner D. The user
ch01.indd 15
10/5/2007 11:30:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
16 17. Which best describes the purpose of the ALE calculation? A. It quantifies the security level of the environment. B. It estimates the loss potential from a threat. C. It quantifies the cost/benefit result. D. It estimates the loss potential from a threat in a one-year time span. 18. How do you calculate residual risk? A. Threats × risks × asset value B. (Threats × asset value × vulnerability) × risks C. SLE × frequency = ALE D. (Threats × vulnerability × asset value) × control gap 19. What is the Delphi method? A. A way of calculating the cost/benefit ratio for safeguards B. A way of allowing individuals to express their opinions anonymously C. A way of allowing groups to discuss and collaborate on the best security approaches D. A way of performing a quantitative risk analysis 20. What are the necessary components of a smurf attack? A. Web server, attacker, and fragment offset B. Fragment offset, amplifying network, and victim C. Victim, amplifying network, and attacker D. DNS server, attacker, and web server 21. In phone phreaking, what is red boxing? A. Voltage manipulation B. Replaying the noise that coins make when dropping into a pay phone C. Using a handheld device attached to a live phone wire to intercept calls D. Tone manipulation 22. What do the reference monitor and security kernel do in an operating system? A. Intercept and mediate a subject attempting to access objects B. Point virtual memory addresses to real memory addresses C. House and protect the security kernel D. Monitor privileged memory usage by applications
ch01.indd 16
10/5/2007 11:30:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 1: Becoming a CISSP
17 Answers 1. B 2. D 3. A 4. A 5. D 6. A 7. A 8. C 9. A 10. A 11. A 12. A 13. C 14. A 15. D 16. C 17. D 18. D 19. B 20. C 21. B 22. A
ch01.indd 17
10/5/2007 11:30:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CHAPTER
Security Trends
2
This chapter presents the following: • Evolution of computing and how it relates to security • Different areas that fall under the security umbrella • The definition of information warfare • Examples of security exploits • A layered approach to security • Politics that affect security
Security is a fascinating topic because it covers so many different areas (physical, network, platform, application, and so on), each with its own risks, threats, and solutions. When information security is discussed, the theme is usually hackers and software vulnerabilities. Although these are big security concerns, they are only two components within the larger field of security issues. Hacking is foremost in people’s minds with regard to security because that is what usually fascinates the media and thus makes the headlines. Hacking is considered flashy and newsworthy, whereas not much coverage is given to what is going on behind the scenes with corporations’ global security issues and the Internet as a whole.
How Security Became an Issue It is interesting to pick up various computer books and see there is usually a history section that sets the stage for where society is today pertaining to computing and data processing. Unlike histories that tell of times long past, the history of computing typically begins in the 1960s. A lot has happened in a short period of time, and computer security is just starting to reach its time in the limelight. Roughly 25 years ago, the only computers were mainframes. They were few and far between and used for specialized tasks, usually running large batch jobs, one at a time, and carrying out complex computations. If users were connected to the mainframes, it was through “dumb” terminals that had limited functionality and were totally dependent on the mainframe for their operations and processing environment. This was a closed environment with little threat of security breaches or vulnerabilities being exploited. This does not mean things were perfect, that security vulnerabilities did not exist, and that people were in a computing utopia. Instead, it meant there were a handful of
19
ch02.indd 19
10/5/2007 11:44:52 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
20 people working in a “glass house” who knew how to operate the mainframe. They decided who could access the mainframe and when. This provided a much more secure environment, because of its simplicity, than what we see in today’s distributed and interconnected world. In the days of mainframes, web sites describing the steps of how to break into a specific application or operating system did not exist. The network stacks and protocols used were understood by very few people relative to the vast number of individuals that understand stacks and protocols today. Point-and-click utilities that can overwhelm buffers or interrogate ports did not exist. This was a truly closed environment that only a select few understood. If networks were connected, it was done in a crude fashion for specific tasks, and corporations did not totally depend on data processing as they do today. The operating systems of that time had problems, software bugs, and vulnerabilities, but not many people were interested in taking advantage of them. Mainframe operators were at the command line and if they encountered a software problem, they usually just went in and manually changed the programming code. All this was not that long ago, considering where we are today. As companies became more dependent on the computing power of mainframes, the functionality of the systems grew and various applications were developed. It was clear that giving employees only small time slices of access to the mainframes was not as productive as it could be. Processing and computing power was brought closer to the employees, enabling them to run small jobs on their desktop computers while the big jobs still took place within the “glass house.” This trend continued and individual computers became more independent and autonomous, only needing to access the mainframe for specific functionality. As individual personal computers became more efficient, they continually took on more tasks and responsibilities. It was shown that several users accessing a mainframe was an inefficient model; some major components needed to be more readily available so users could perform their tasks in an efficient and effective way. This thinking led to the birth of the client/server model. Although many individual personal computers had the processing power to compute their own calculations and perform their own logic operations, it did not make sense that each computer held information needed by all other computers. Thus, programs and data were centralized on servers, with individual computers accessing them when necessary and accessing the mainframes less frequently, as shown in Figure 2-1. With the increasing exposure to computing and processing, individuals who used computers learned more about using the technology and getting the most out of it. However, the good things in life often have a darker side. Taking technology down from the pedestal of the mainframe and putting it into so many individuals’ hands led to many issues never before dealt with in the mainframe days. Now there were thousands of inexperienced users who had much more access to important data and processes. Barriers and protection mechanisms were not in place to protect employees and systems from mistakes, so important data got corrupted accidentally, and individual mistakes affected many other systems instead of just one.
ch02.indd 20
10/5/2007 11:44:59 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
21
Figure 2-1 The relationship between a mainframe, servers, and workstations
Because so many more people were using systems, the software had to be made more “idiot-proof” so that a larger audience could use the same platform. Computer operators in the mainframe days understood what the systems expected, how to format input, and how to properly read output. When this power was put into individuals’ desktops, every imaginable (and unimaginable) input was used, which corrupted information and mangled operating systems. Companies soon realized that employees had to be protected from themselves and that data had to be protected from mishaps and mistakes. The employees needed layers of software between them and the operating system components and data they could potentially destroy. Implementing these layers not only enhanced security—by separating users from the core of the operating systems and files—but also increased productivity as functionality continued to be inserted to make computers more useful to businesses and individuals. As the computing world evolved, symbiotic relationships grew among the technological advances of hardware, circuitry, processing power, and software. Once a breakthrough was made that enabled a computer to contain more memory and hard drive space, new software was right on its heels to use it and demand more. When software hit a wall because it was not supplied with the necessary registers and control units, the hardware industry was Johnny-on-the-spot to develop and engineer the missing pieces to the equations. As the hardware end grew to provide a stable and rich platform for software, programmers developed software that provided functionality and possibilities not even conceived of a few years earlier. It has been a wonderful game of leapfrog that does not seem to have any end in sight. Lovely story, but what does it mean to security?
ch02.indd 21
10/5/2007 11:45:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
22 In the beginning, the issues associated with bringing computing closer to individuals brought along many mistakes, technological hurdles, and operational issues not encountered in the workforce before. Computers are tools. Just as a knife can be a useful tool to cut meat and vegetables, it can also be a dangerous tool if it is in the hands of someone with malicious intent. The vast capabilities and functionality that computers have brought to society have also brought complex and troubling methods of destruction, fraud, abuse, and insecurity. Because computers are built on layers (hardware platform, chips, operating systems, kernels, network stacks, services, and applications), these complex issues have been interwoven throughout the strata of computing environments. Plugging the holes, writing better software, and providing better perimeter security are often easier said than done because of the density of functionality within an infrastructure, interoperability issues, and the availability requirements of the necessary functionality. Over a short period of time, people and businesses have come to depend greatly upon computer technology and automation in many different aspects of their lives. Computers run public utilities, military defense systems, financial institutions, and medical equipment, and are heavily used in every possible business sector. Almost every company relies on data processing for one reason or another. This level of dependence and the extent of integration that technology has attained in our lives have made security a much more necessary and essential discipline. Computer security is a marathon to be run at a consistent and continual pace. It is not a short sprint, and it is not for those who lack dedication or discipline.
Areas of Security Security has a wide base that touches on several different areas. The developers of the CISSP exam had the vision to understand this and demand that an individual who claims to be a security expert and wants to achieve this certification must also show that his expertise does not just lie in one area of security. Many areas of security affect each other. Physical security is interrelated with information security, database security lies on top of operating system security, operations security affects how computer systems are used, disaster recovery deals with systems in emergency situations, and almost every instance has some type of legal or liability issue tied to it. Technology, hardware, people, and procedures are woven together as a security fabric, as illustrated in Figure 2-2. When it is time to identify and resolve a specific problem, several strands of the security fabric may need to be unraveled and scrutinized so the best and most effective solution can be provided. This chapter addresses some specific security issues regarding computers, information, and organizations. This is not an attempt to cover all relevant subjects, but rather to show specific instances to give you an idea of the vast area that security encompasses. The information in these sections is provided to set the stage for the deeper levels of coverage that will be addressed in the following chapters.
ch02.indd 22
10/5/2007 11:45:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
23
Figure 2-2 Technology, hardware, people, and procedures are woven together as a security fabric.
Benign to Scary Computers and networks touch every facet of modern life. We are increasingly dependent on computer/network technology for communication, funds transfers, utility management, government services, military action, and maintaining confidential information. We use technology to provide energy, water supplies, emergency services, defense systems, electronic banking, and public health services. At the same time, this technology is being abused to perform illegal or malicious activities, such as to steal credit card numbers, use telephone systems fraudulently, illegally transmit trade secrets and intellectual property, deface web sites for political reasons, disrupt communications, reveal critical national secrets and strategies, and even commit extortion. The term “information warfare” covers many different activities that pertain to individuals, organizations, and nations. Information warfare can be defined as any action to deny, exploit, corrupt, or destroy the enemy’s information and its function, while at the same time protecting oneself against those same actions. Governments have used information warfare techniques to gather tactical information for years. Organizations have stolen competitors’ trade secrets and plans for new products before they were released. Individuals have also used computers to steal money, access personal financial information, steal individual identification information, deface web sites, and cause destruction to draw attention to a particular cause. There once was a time when hacking activities, viruses, and malware incidents were relatively benign. Many hackers carried out such activities to impress their peers and show they were clever enough to disrupt some businesses here and there, but overall their intent was not to inflict massive damages to an entity.
ch02.indd 23
10/5/2007 11:45:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
24 But where once the developer of a worm or virus received only the self-satisfaction of overcoming a challenge, things today have changed dramatically. The trend of hacking for “fun” is disappearing, to be quickly replaced by hacking with profit-driven motives. There is an old saying that goes, “Why did the thief rob the bank?” Answer: “Because that was where the money was kept.” If we apply that to today’s world, it may go more like this: “Why are the thieves hacking computers?” Answer: “Because today that is where the financial information and critical data are kept.” Today, security breaches, malware, and hacking often target specific victims and have specific goals. Viruses used to spread via users opening attachments, followed by the virus sending copies of itself to the victim’s contact list. Thus, it simply replicated itself—big deal. Now, hackers work together to steal data used for identity theft, they raid funds from online accounts, and carry out extortion when holes are discovered in a company’s security program. Some individuals are even being hired by organized crime rings for just such objectives. In short, hacking is constantly evolving. In an industry driven by continual technological innovation, hackers remain abreast of these changes and often are a step ahead of the good guys who are trying to protect company assets. The level of sophistication has increased as well because the stakes are now that much higher. It is not unheard of for organizations to secretly employ hackers to perpetrate all kinds of maliciousness against their competitors. Everything from business contracts, customer lists, industrial secrets, product blueprints, and financial data can be culled from an organization’s computer systems by those with the necessary technological skills if aided by security weaknesses at the target organization. Routinely, news stories arise about international crime rings targeting banks and credit card companies through cyberattacks, the results of which are the loss of millions of dollars, through identity fraud and outright theft of funds. In many cases, the greatest damage done to these companies is to their reputations and the confidence consumers have in the organizations.
Evidence of the Evolution of Hacking Several incidents indicate that not only is hacking activity on the rise, but the sophistication of the attacks is advancing rapidly. Alarmingly, a majority of attacks are using methods that have been understood for quite some time and for which fixes have been readily available. This proves that not enough network maintainers have kept up-todate on security changes and installed the necessary patches or configurations. It is an unfortunate, but common occurrence to see hackers exploiting the various computer vulnerabilities in order to steal millions of credit card and account numbers from systems associated with e-commerce, online banking, or the retail sector. Some hackers will extort the organization with the threat of releasing the sensitive data to others. The hackers will offer a “security service” to fix the systems they have attacked for a fee, and if the institutions do not agree to pay, the attackers will threaten to do even more damage by posting the customers’ credit card numbers on web sites available to the public. Some organizations call the hacker’s bluff and refuse to pay, while some organizations pay the “hush money” and get the FBI involved. The public is often very much in the dark about the kinds of damages worms, viruses, and hacks have done to companies. Unless these events make the news, the attacked or-
ch02.indd 24
10/5/2007 11:45:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
25 ganization usually only notifies their customers when absolutely necessary, or just sends them new cards and account numbers without any real explanation as to why they are being issued. It is usually only when more and more people are affected by attacks that they make the news and the general public becomes aware of them. Because of this common secrecy of security breaches, a majority of the states in America have privacy laws that require customers to be told of these issues that could directly affect them. Organizations have their own motivation behind keeping the news about these kinds of attacks as quiet as possible. First, they don’t want to lose their customers due to a lack of confidence and thereby lose their revenue. Secondly, they don’t want to announce to the world that they have holes in their enterprises that lead right to the company jewels. Public knowledge of these vulnerabilities can bring about a storm of new attackers. It is similar to being attacked by a shark in the ocean only to have more sharks appear for their afternoon snack. It is not pretty. Most of us know about Paris Hilton’s stint in jail; yet we are not aware of the continuous computer crimes that are taking place around us. The following sections show just some examples of activities that take place. Visit www.cybercrime.gov to see other convictions that have taken place. There have been many reported and unreported financially motivated attacks. It was reported on February 2, 2007 that a former state contractor allegedly accessed a workers’ compensation data file at the Massachusetts Department of Industrial Accidents and stole personal information, including Social Security numbers. The thief is known to have used that information to commit identity theft on at least three of the individuals whose information was stolen. It is believed that as many as 1200 people have been affected by this theft. On February 28, 2006, Kenneth J. Flury, a 41-year-old man from Cleveland, Ohio was sentenced to 32 months in prison and three years of supervised release as a result of his convictions for bank fraud and conspiracy. Flury was ordered to pay CitiBank $300,748.64 in restitution after having been found guilty of trying to defraud CitiBank between April 15, 2004 and May 4, 2004. He had obtained stolen CitiBank debit card numbers and PINs and then used them to encode blank ATM cards. He then used the counterfeit ATM cards to obtain cash advances totaling over $384,000 from ATM machines located in the Cleveland area during a three-week period. To pay off his accomplices, $167,000 of the stolen funds was transferred by Flury to the criminals who provided him with the stolen CitiBank account information. These individuals were later located in Europe and Asia. An additional $32,345 was seized by law enforcement officials before it could be transferred to accomplices in Russia. Though company-to-company espionage usually flies under the public’s radar, there is nonetheless a great deal of activity in this area also. On August 25, 2006, a man in Michigan was sentenced to 30 months in prison for conducting computer attacks upon a competitor of his online sportswear business. Jason Salah Arabo, 19, of Southfield, Michigan was ordered to make restitutions of $504,495 to his victim. Arabo and an accomplice remotely controlled some 2000 personal computers they had infected with malware to conduct distributed Denial-of-Service attacks upon their competitor’s servers and web sites, thus completely disrupting the victim’s business. Early in 2005, the MyDoom virus infected hundreds of thousands of computers, which were then used to launch an attack on the SCO Group. The attack was successful
ch02.indd 25
10/5/2007 11:45:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
26 and kept the Utah-based Unix vendor from conducting business for several days. Although no official reason for the attack was ever uncovered, it is believed to have something to do with the fact that IBM was being sued by SCO for $5 billion. One of the most frustrating aspects of these kinds of extortion attacks is that they aren’t limited to what are considered traditional borders. On Valentine’s Day of 2006, a group of animal activists organized an event where they encouraged people to log in to their chat room. Every word typed during this “chat” then triggered an e-mail to a list of predetermined organizations in the fur industry, and other companies that conducted animal vivisection. Such examples demonstrate that cyber-extortion isn’t solely motivated by money, and can arise for any number of reasons. In June of 2006, the Department of Justice (“DOJ”) (in an operation appropriately named “Operation French Fry”) arrested eight persons (a ninth was indicted and declared a fugitive) in an identity theft ring where waiters had “skimmed” debit card information from more than 150 customers at restaurants in the Los Angeles area. The thieves had used access device-making equipment to re-stripe their own cards with the stolen account information, thus creating counterfeit debit cards. After requesting new PIN numbers for the compromised accounts, they would proceed to withdraw money from the accounts and use the funds to purchase postal money orders. Through this scheme, the group was allegedly able to steal over $1 million in cash and money orders. A recent attack in Louisiana shows how worms can cause damage to users, but not in the typical e-mail attachment delivery system we’re used to. The case, United States v. Jeansonne, involved users who subscribed to WebTV services, which allow Internet capabilities to be executed over normal television connections. The hacker sent an e-mail to these subscribers that contained a malicious worm. When users opened the e-mail, the worm reset their Internet dial-in number to 911, the emergency services number. As a result, several areas, from New York to Los Angeles, experienced false 911 calls whenever a user attempted to connect to their web services. The trick the hacker used was an executable worm. When launched, the users thought a simple display change was being made to their monitor, such as a color setting. In reality, however, the dial-in configuration setting was altered. In some cases, the loss of information that can have a detrimental effect upon an organization and its customers is done accidentally. On January 26, 2007, a woman in Bossier purchased a used desk from a furniture store. Once the desk was delivered, she discovered a 165-page spreadsheet in one of the drawers, containing the names and Social Security numbers of current and former employees of Chase Bank in Shreveport, Louisiana. Although the document was returned immediately, the information on these 4100 individuals could have been used for illegal, and perhaps devastating, undertakings had the finder of the list been less honest. In early 2005, Choicepoint, a data gathering company, allowed individuals, who they thought were representing legitimate companies, access to 145,000 records within their database. The records held extensive private information on American citizens that could easily be used for identify theft. These individuals created several phony companies and used Choicepoint’s information service to gather personal data. Each phony company collected the data over a period of time, thus keeping the whole operation under Choicepoint’s radar. The individuals pieced together the information and com-
ch02.indd 26
10/5/2007 11:45:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
27 piled essentially full financial information on the victims, from credit reports to Social Security numbers. Only one person was arrested and received 16 months in jail. In March 2005, hackers obtained 1.4 million credit card numbers by carrying out an attack on DSW Shoe Warehouse’s database. In addition to obtaining credit card information, the attackers gained driver’s license numbers and checking account numbers from 96,000 accounts. In 2005, LexisNexis notified around 280,000 people that their passwords and IDs may have been accessed and stolen, and Bank of America lost their data backup tapes, which contained credit card account information for at least 1.2 million federal employees, many of whom worked at the Pentagon. Examples of attempts to gain personal information are rampant. After discovering that fraudulent e-mail messages purporting to be from the Internal Revenue Service were being sent in an attempt to gain personal information, the IRS issued a notice that it does not use e-mail to contact taxpayers about issues related to their accounts. Yahoo .com issued warnings to its members to be careful about which web page they attempt to sign in on. Yahoo cautioned that the http://mail.yahoo.com/ address must include the trailing slash after the yahoo.com designation, otherwise the address that appears in the browser page could be bogus, an attempt to impersonate the official web site’s sign-in page—as in the following, which was cited by Yahoo: http://www.yahoo.com: login&mode=secure&i=b35870c196e2fd4a&q=1@16909060. The nonprofit organization Identity Theft Resource Center (www.idtheftcenter.org) issues notices about the latest scams and consumer alerts and states that identity theft is the fastest growing crime in America today. Many of the compromises come from fraudulent e-mails (scams) and carelessly developed online shopping and online banking software. A variation of the scams includes the account verification schemes in which the thief attempts to obtain information from unsuspecting e-mail recipients by sending a mass e-mail message, purporting to be from eBay, PayPal, a bank, or some other legitimate organization, with an “Urgent” request for account verification and a warning that their account is about to expire. A link is provided that, when clicked, leads the victim to a web page that looks legitimate and asks for account information. These are known as phisher scams. These examples sadly represent only a small percentage of the hacking activity going on. These attacks were identified and reported. Most are not. Many organizations do not report hacking activity because they are afraid of damaging their reputation, losing the faith of their customer base, and adversely affecting their shareholders and stock prices. Other attacks go unnoticed or unidentified, and thus are not reported, while international attacks against military and government systems typically go unreported to the public. So, even though computers and networks remain great tools and have brought society much advancement, like many other tools, they are often used for sinister purposes.
How Are Nations Affected? The art of war requires soldiers to outmaneuver the enemy and strike them down if necessary. In traditional warfare, the enemy was usually easily detectable. They were driving a tank, bombing from an airplane, attacking from a submarine, or shooting
ch02.indd 27
10/5/2007 11:45:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
28 missiles. Today, the enemy may be harder to find, some attacks are harder to track, and the objectives of the attacker are at times more nebulous. Many governments’ military intelligence agencies have had to develop new methods of collecting information on potential foreign enemy movement, conducting surveillance, and proving guilt in criminal activities. Although militaries still train most soldiers how to shoot, fight in combat, and practice evasive maneuvers, a new type of training is being incorporated. Because a majority of the military vehicles, weapons systems, and communication systems are controlled by technology, new soldiers must know how to use these technological tools to achieve the same goal of the soldier of the past—to win in war. Today’s soldiers not only need to know how to operate the new technology-driven weapons systems, but how to defend these systems from attacks and possibly use them to attack the enemy’s defense systems. Disrupting communication has always been an important tactic in war because it impedes proper planning and warnings of imminent attacks. Knocking out communication lines is one of the first steps in the recipe of a successful attack. Today, most military communication is handled through computer-based systems, and the tools to disrupt communication of the enemy have changed. For example, the CIA reported to a U.S. congressional committee that foreign nations include information warfare in their military arsenal and provide defensive and offensive attack methods. These nations are devising documentation, strategic plans, and tools to carry out information warfare on other nations. During the Persian Gulf War in 1991, it was reported that hackers from the Netherlands penetrated 34 American military sites that supported Operation Desert Storm activities. They extracted information about the exact location of military troops, weapon details, and movement of American warships. It could have been a different war if Saddam Hussein had actually bought this information when it was offered to him, but he did not—he thought it was a trick. In another example, it was reported that the Irish Republican Army stole telephone bills to determine the addresses of potential targets in their political attacks. Authorities seized a batch of computer disks in Belfast and were able to decrypt the information after months of effort. This information was most likely gained by successfully hacking into the telephone company’s database. A report declassified in May 1995 stated that prior to the August 1991 coup attempt in the Soviet Union, the KGB had been writing and developing viruses to disrupt computer systems during times of war. Another report, by the U.S. Defense Intelligence Agency, indicated that Cuba had developed viruses to infect and damage U.S. civilian computers. There is no proof these viruses were released and actually caused damage, but there is no proof they weren’t released either. It has also been reported that during the 1999 Kosovo Air Campaign, fake messages were injected into Yugoslavia’s computer-integrated air defense systems to point the weapons at false targets. Examples like these make it clear that military use of computer-based tools and attacks is growing in sophistication and utilization. Critical to the function of the Internet are the 13 root DNS servers that participate in managing Internet traffic. If some of these go down, some web sites may become
ch02.indd 28
10/5/2007 11:45:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
29 unreachable and some e-mail may not delivered. If they all came down, the Internet would basically stop functioning. On February 6, 2007, another cyberattack occurred that targeted the 13 root DNS servers. Three computers used in this capacity were overwhelmed, but to the great relief of many, the attack went largely unnoticed by most computer users around the globe. Computer scientists involved claim this is due to the increased resiliency of the Internet and the sharing of duties that has taken place since the last major attack upon these computers in 2002. Today, reports indicate that many terrorists groups are now using propaganda on the Internet to find prospective recruits. Luckily, these tactics have also spawned their cyber opposites, such as the cyber-antiterrorist group, Internet Haganah, founded by Aaron Weisburd. Weisburd, and others like him, now track down terrorist-related web sites and pose as individuals sympathetic to the web sites’ creators. They then gather as much information as they can and pass it along to various law enforcement agencies in order to shut down the web sites and, when possible, prosecute those responsible. In another aspect of cyberterrorism, the U.S. Department of Defense believes at least 20-some countries have now established Cyber War organizations in an effort to create and develop the tools and techniques needed to attack other national militaries and civilian targets via the Internet. Possible Cyber Wars like this are already a reality. The number of attacks and intrusion attempts on the Department of Defense (DoD) has continued to rise in recent years. In some cases, the DoD has endured more than 500 cyberattacks a day. Fortunately, the number of successful attempts has declined due to a strategic effort to train personnel and implement the best security measures available. Almost every task in an individual’s day interrelates with a technology that is controlled or monitored by a computer-based system. Turning on the lights, paying a gas bill, flying on a plane, talking on the telephone, and receiving medical treatment are all events that depend on large computer systems monitoring and providing a flow of service. Even sophisticated military defense systems rely on commercial power, communication, transportation, and monitoring capabilities that are computer-based. A country’s strength depends on its privately owned critical infrastructures and industries. These private-sector infrastructures have already been victimized by computer attacks, and a concerted attack on any of these key economic sectors or governmental services could have widespread ramifications. Most governments have recognized this vulnerability and have started taking the necessary defense steps because it is very likely that in future wars a country’s entire infrastructure could be targeted via these new methods—computer-generated attacks. NOTE The examples here are U.S.-centric, but the CISSP exam is not. It has evolved over the years to have a greater international focus.
How Are Companies Affected? Many companies fail to understand how security implementations help their bottom line. After all, businesses are created to turn a profit, and if there is no direct correlation for an item—tying it in neatly to the linear concept of cost and profit—that item is
ch02.indd 29
10/5/2007 11:45:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
30 often given low priority. Thankfully, more companies today are discovering how security affects their bottom line in ways they never expected. If a company suffers a security breach, it must deal with a wide range of issues it likely wasn’t prepared for. Several companies recently had their databases attacked and their customers’ information compromised. Once customers find out that a company is not protecting their confidential and financial information properly, they will often take their business elsewhere. If the number of customers affected is in the range witnessed over the last year (10,000 to 1.4 million credit cards stolen at a time), and if the company loses a similar number of customers at one time, the company could go out of business. Of course, these events also affect the reputation of the company, its shareholders, and its stock price. In addition, the customers can sue the company, which could result in punitive damages and court fees. This would definitely impact the bottom line. NOTE Companies have added detailed security questions to requests from business partners. Many request for proposals (RFPs) now include questions regarding security practices, infrastructure, and how data will be protected. Organizations have had trade secrets and intellectual property stolen by employees who left to work for a competitor. In such instances, unless the original company has taken the proper steps to protect this data and inform its employees that this action is wrong, the company has no legal recourse. The company must practice due care both inside and outside its walls to protect its intellectual property from competitors. (For more information on legal issues, see Chapter 10.) The industry is seeing more and more cases of employees being fired for improper use of computer systems. Many large companies have instituted policies of zero tolerance with respect to unauthorized or improper computer and Internet usage. However, if companies do not take the proper steps by having a comprehensive security policy in place and providing security awareness to the employees, they are often successfully sued for unfairly ending employment. Companies and organizations are increasingly finding themselves responsible for compliance with more and more regulations pertaining to how they handle their data and personal information. The following is a short list of different privacy and confidentiality regulations: • Electronic Communications Policy (ECP) • Health Insurance Portability and Accountability Act (HIPAA) • Public Records Act (PRA) • Information Practices Act (IPA) • Family Educational Rights and Privacy Act (FERPA) • Children’s Online Privacy Protection Act (COPPA) • Fair Credit Reporting Act (FCRA) • Gramm-Leach-Bliley Act • Sarbanes-Oxley Act of 2002
ch02.indd 30
10/5/2007 11:45:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
31 Many other regulations are imposed at the state and federal levels, which companies need to comply with in how they conduct their business. It is important to know that many of these regulations go much further than to just dictate the levels of protection a company must provide for the data they are responsible for. It is becoming more common to see these newer regulations requiring that CEOs and CFOs of organizations be held personally responsible, and perhaps criminally negligent, if anything untoward occurred in regards to the data they have been entrusted with. Long gone are the days where upper management can claim they didn’t realize what was going on at lower levels of their organization. These regulations and laws can hold them directly accountable, and require them to sign off on regular reports and audits pertaining to the financial health and security of their organizations. Another way a company can lose money and time is by being ill-prepared to react to a situation. If a network does not have properly configured security mechanisms, the company’s IT staff usually spends unnecessary time and resources putting out fires. In addition, when they are racing in a chaotic manner to find a solution, they may be creating more open doors into the network without realizing it. Without proper security planning, a lot of money, staff productivity, and time are wasted that could be used for other tasks. As discussed in subsequent chapters in this book, companies that have a solid incident response plan or disaster recovery plan in place will know what to do in the event of a physical intrusion or cyberattack. Many companies are covered by insurance in case of a natural disaster or a major security breach. However, to get a good insurance rate, companies must prove they have a solid security program and that they are doing all they can to protect their own investments. In some cases, insurance providers refused to pay for a company’s loss because the company failed to have the correct security measures in place. A recent legal case involved a company that did not have a security policy, proper security mechanisms, and an updated disaster recovery plan in place. When disaster struck, the insurance company refused to pay. The case went to court and the insurance company won; however, the greater loss to the company was not the court case. Every business market is full of competition. If a company endures a security compromise that makes the press—which has been happening almost every month over the last year—it will have an even harder time attracting new business. A company wants to be in a position where all the customers come to it when another company suffers a security compromise, not the other way around.
The U.S. Government’s Actions One of the U.S. government’s responsibilities is to protect American resources, people, and their way of life. One complex task the government has been faced with recently is protecting several critical infrastructures from computer-based attacks. Because computer technology is relatively young and changing rapidly, and because security has only come into real focus over the last few years, all these core infrastructures contain their own vulnerabilities. If attackers disrupt these infrastructures, the ramifications may be far reaching. For example, if attackers were able to take down electrical grids, thus forcing the government to concentrate on that crisis, they could then launch military strikes on other fronts. This might sound like a John Grisham novel, but the U.S. government must consider such scenarios and devise defensive plans to respond. One
ch02.indd 31
10/5/2007 11:45:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
32 of the biggest threats the United States faces is that terrorists or a hostile nation will attempt to inflict economic damage, disrupt business or productivity, and degrade our defense response by attacking the critical infrastructures. On July 15, 1996, President Clinton approved the establishment of the President’s Commission on Critical Infrastructure Protection (PCCIP). The responsibility of this commission was to investigate the types of attacks that were happening, extrapolate how attacks could evolve in the future, determine how they could affect the nation’s computer infrastructures, and assess how vulnerable these structures were to such attacks at that time. The PCCIP published its sobering report, “Critical Foundations: Protecting America’s Infrastructures,” in 1997. The report outlined the current vulnerability level of critical U.S. infrastructures pertaining to criminal activity, natural disasters, international terrorists, hackers, foreign national intelligence, and information warfare. Longstanding security weaknesses, placing federal operations at serious risk, were identified and reported. In response to this report, President Clinton signed two orders, Presidential Decision Directives (PDDs) 62 and 63, to improve the nation’s defenses against terrorism, other computer-based attacks, and information warfare activities. The focus of these directives was to address cyberattacks at a national level. The report recognized that many of the nation’s critical infrastructures were privately owned and operated. It was obvious the government and the private sector had to work together to properly and successfully defend against cyberattacks. In fact, it was recognized that these government departments could not provide this level of protection without the help and sharing of information with the public sector. The position of National Coordinator was created within the Executive Office of the President to facilitate a partnership between the government and the private sector. The goal was for the government and the private sector to work together to strengthen the nation’s defenses against cyberterrorism, theft, fraud, and other criminal activity. Out of this came the Critical Infrastructure Assurance Office (CIAO) under the Department of Commerce, Information Sharing and Analysis Centers (ISACs), and the National Infrastructure Protection Center (NIPC) under the sponsorship of the FBI. Recently, the NIPC was fully integrated into the Information Analysis and Infrastructure Protection Directorate of the Department of Homeland Security (DHS). Thus, the former NIPC’s responsibilities of physical and cyber-critical infrastructure assessment are now being addressed by two new divisions. ISACs provide a mechanism that enables information sharing among members of a particular industry sector. The information comes from public-sector organizations and government agencies, and is shared by both. Sources of information can be authenticated or anonymous, and the information can pertain to vulnerabilities, incidents, threats, and solutions. Submitted information is directed to the appropriate team members, who then investigate each submittal, quantify the seriousness of the vulnerability, and perform a trend analysis to identify steps that might thwart this type of attack. The intent is to enhance the security of individual organizations, as well as the entire nation, one industry sector at a time. In 2002, President Bush created the Office of Homeland Security in response to the attack on the United States on September 11, 2001. Departments of information tech-
ch02.indd 32
10/5/2007 11:45:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
33 nology and cybersecurity were included, and specific committees and roles were developed to protect against attacks that could negatively affect the nation’s infrastructure. The bill was signed November 25, 2002, and allocated $2.12 billion for technology and cybersecurity. Much like the position of Drug Czar in the War on Drugs, in many countries in recent years there has also been a call for the appointment of a Cyber Czar—that is, a government official responsible for keeping the critical infrastructure of a country’s cyberworld secure and protected. In the U.S., it has proved to be a revolving-door post at the White House, with no real worth. The position is part of the Department of Homeland Security and actually oversees two other divisions: the National Communications System division and the National Cyber Security division. Many experts in the security industry feel that ever since President Bush issued his national strategy to secure cyberspace in February of 2003, nothing has really been done, and that those policies that have been created have been non-starters. Since 2001, more than four people have held the position of Cyber Czar, and in one instance (Howard Schmitt), for only two months. Many of the Cyber Czars have quit due to a lack of support or a feeling that the position and its division weren’t being taken seriously by other government agencies. Late into 2006, the position still remained open (and had remained open for more than a year), with the Bush Administration claiming they were whittling down the list of possible candidates. The position was eventually filled, but why should there be such difficulty in filling what, in reality, is such an important and essential job? Critics and industry insiders claim it is tough to fill this position for several reasons. The first is the strong perception that the job holds no real power or influence in government circles. Critics cite that the Bush Administration talks a big game, but in reality does very little—if nothing at all—in regards to fighting cyberterrorism. The second reason is the need to find people who are properly qualified to hold the position. This is difficult due to the specific requirements of the job, such as having a strong understanding, not only of the nature of current threats and the technology involved, but also in having the foresight to implement strategies that will protect the nation’s computer infrastructure in the future as well. Such undertakings require both active and proactive planning, and a forceful implementation of policies. The third reason for the difficulties in hiring is that the private sector at this time pays more, and offers more, to those individuals best suited for the position. Government leadership also often claims that the private sector is doing enough to secure the nation’s infrastructure. To this, though, the private sector usually responds that the government still must do more, and take their own initiatives, and claims that the government is doing little, if anything at all, in these areas. Many criticisms of this type focus on the lack of leadership and cohesive policies coming from the Department of Homeland Security. Audits of both the DHS and the Department of Defense’s security procedures have given failing scores in recent evaluations, leaving the private sector questioning the government’s leadership abilities. The government, in turn, criticizes the evaluation process they’ve undergone. At the end of the day, however, both the public and government sectors must work together and grow stronger in these areas because the threats to the nation’s cyber-infrastructure are becoming more dangerous all the time.
ch02.indd 33
10/5/2007 11:45:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
34 So What Does This Mean to Us? Evidence and trend analyses show that people, businesses, and countries are becoming increasingly dependent on computer/network technology for communication, funds transfers, utility management, government services, and military action. If any of these experienced a major disruption, millions of people could be affected. As our dependence grows, so should our protective measures. The reality of the world today is that the majority of computer attacks, hacks, and cracks are no longer done for kicks and thrills. It’s no longer about the measure of skills. Greed and financial gain are the greatest motivators for most attacks these days. The perpetrators are no longer just individuals trying to make a name for themselves; instead, there is more organized crime and financial motivation behind these attacks. The gambit runs from botnets to spammers to identity theft. The lure of fast money through anonymous means brings all kinds of malicious elements out of the woodwork to take a crack at hacking and cybercrime. The fact that many organizations don’t want to report these kinds of crimes and have the public know about these attacks occurring against them only sweetens the lure for criminals to steal and extort every possible dime out of their victims. Militaries are quietly growing their information warfare units. This growth is a response to the computer-related military actions that have already occurred and reflects an awareness of the need to plan for the future. Computer networks, communication systems, and other resources not only are prime targets to reconfigure or destroy in the time of war or crisis, they are also good tools to use to watch other nations’ movements and estimate their intentions during peacetime. The antes are being raised, security issues are becoming more serious, and the effects are more detrimental. Take the necessary steps to protect yourself, your company, and your country.
Hacking and Attacking There has been a definite and distinct evolution of hacking, cracking, and attacking. At one time, it was a compliment to be called a hacker because it meant you took the time to learn things about computers that others did not know and had the discipline and desire to find out what makes a computer tick. These people did not perform malicious acts, but rather were the ones called upon when really tough problems left everyone else scratching their heads. As computers became more widespread as tools, this definition started to change. The new hackers took on a profile of geeky young men who would rather spend their time pinging computers all over the Internet than looking for dates. Even this profile has evolved. Girls and women have joined this once all-male club and are just as knowledgeable and dangerous as the guys. Hacking is on the rise, and the profile of an attacker is changing. However, the real change in the profile is that the serious attackers indulge themselves for specific reasons and have certain types of damage or fraud in mind. The dangerous attacker is the one who is willing to do his homework. He will build a profile about the victim, find all the necessary information, and uncover many possible ways of getting into an environment before actually attempting it. The more an at-
ch02.indd 34
10/5/2007 11:45:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
35 tacker knows about the environment, the more access points he has at his disposal. These are usually groups of determined and knowledgeable individuals that are hard to stop. Another dangerous evolutionary pattern is that the tools available to hackers these days are easy to use. It used to take a certain skill set to be able to enter a computer through a port, reconfigure system files, find the hidden data, and get out without being noticed. Today, there are many tools with graphical user interface (GUI) front-ends that only require a person to enter an IP address or range, and then click the Start button. Some of these tools provide a quiet mode, which means the interrogations and exploit attempts will use methods and protocols that may not show up on intrusion detection systems (IDSs) or cause the user of that computer to recognize something is going on. These tools enable people to carry out sophisticated attacks even if they do not understand the tool or the attack itself. The proliferation of tools on the Internet, the ease of use of these tools, and the availability of web sites and books describing exactly how to exploit vulnerabilities have greatly increased the hacker population. So, some attack tools whose creation may have required in-depth knowledge of protocol behaviors or expert programming skills are now available to a wide range of people who have not necessarily ever heard of Transmission Control Protocol/Internet Protocol (TCP/IP). As more vulnerabilities are uncovered every week, many more people are interested in trying out the exploits. Some just want to satisfy their curiosity, some want bragging rights over other hackers, and some have distinct destructive goals to accomplish. There is another aspect to hacking and attacking, though. It is natural to focus on the evil aspects, but hacking can also be looked at as a continuous challenge to the computing society to come up with better products, practices, and procedures. If hackers were not continually trying to break products, the products would not necessarily continue to evolve in the way they have. Sure, products would continue to grow in functionality, but not necessarily in security. So maybe instead of looking at hackers as selfish individuals out to cause harm and destruction, they can be looked at as the thorn in the side of the computing society that keeps it on its toes and ensures that the next product will provide greater functionality, but in a secure manner.
Management Security is a complex matter for many companies. Management usually feels the IT department is responsible for choosing the correct technologies, installing and maintaining them, and keeping the environment secure. In general, management has never really been pulled inside the realm of computers and the issues that surround them. This distance and mentality hurts many companies when it comes to dealing with security effectively. Historically, management has been responsible only for hitting its numbers—whether it be profit margins, sales goals, or productivity marks—and for managing people and projects. It has not had to think much about firewalls, hackers, and security breaches. However, this mindset is fading, and the new trend demands that management be much more involved in security and aware of how it affects the company as a whole.
ch02.indd 35
10/5/2007 11:45:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
36 It is management’s responsibility to set the tone for what role security will play in the organization. Management must decide which data are valuable and need to be protected, who is responsible for protecting the data, to what extent employees may access and use the data, and what the consequences are for noncompliance. However, as of this writing, few corporations see these issues in this light and instead bounce the responsibility for security back to the IT staff. The reason, usually, is not that management is trying to avoid blame for security lapses or shirk its responsibility, but rather that it lacks understanding of what information and enterprise security entails. Many organizations incorrectly assume that information security is a technical issue. It is not. Information security is a management issue that may require technical solutions. This is why information security professionals are so important. They must understand not only the goals and objectives of the organization, but also the technical issues involved in securing those assets that are most important. Good security does not begin and end with erecting a firewall and installing antivirus software. Good security is planned, designed, implemented, and maintained, and is capable of evolving. For security to be a good fit for a company, it must be in line with the company’s business goals and objectives. Management needs to understand security issues and how security affects the company and its customers so that proper resources, time, and funding can be provided. In other words, information security should be applied in a top-down approach. Unfortunately, many times security is kept within the IT department, which can be overwhelmed with daily tasks and dealing with weekly disasters. In these cases, security is done in a reactionary, bottom-up approach, which drastically reduces its effectiveness. In addition, when the IT department requests funds for security purposes, their entreaty often falls on deaf ears. It is too much responsibility to put the full brunt of the security of a whole company on the IT department. Security must be understood, supported, and funded from the top down. Management does not need to know the security mechanisms used, the protocols in place, or the configurations of components, but it does need to set the stage for everyone else to follow. Management should provide the framework, as well as the delegate who will fill in the rest. In February 2004, Wells Fargo Bank suffered its second theft of a laptop computer that contained confidential information from its customer database. The first laptop that was stolen, in November 2003, contained a database of 200,000 customer records. In the February 2004 incident, two Wells Fargo employees were in a St. Louis, Missouri gas station/convenience store, with their rental car parked outside. When they returned to their car, all the contents of the vehicle, including the laptop in the trunk, were gone. Wells Fargo waited more than a month before it notified the affected customers. In early December of 2006, an employee of Boeing in Seattle, Washington had his laptop stolen from his car. The computer contained files with the names, salary information, Social Security numbers, home addresses, phone numbers, and dates of birth of both former and current employees. In all, the information of more than 382,000 individuals was lost. The day after the event was reported, Boeing fired the employee that lost the laptop. Over a month later, the laptop was recovered, but the extent of the damage had yet to be determined. On November 23, 2006, two computers (a desktop and a laptop) were stolen from Electronic Registry Systems, a contractor that provides cancer patient registry data pro-
ch02.indd 36
10/5/2007 11:45:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
37 cessing services. The files on these computers contained the personal information of cancer patients from hospitals in Tennessee, Ohio, Georgia, and Pennsylvania dating back to 1977 at some of the facilities. The theft affected more than 63,000 patients. Thefts like this can occur at any time and to anyone within an organization. In another incident, on December 6, 2006, a report was stolen from the car of the Vice President of Premier Bank, containing the names and account numbers of 1800 customers. Luckily, no Social Security numbers were involved. When a company is hacked and thousands of customers’ credit cards are stolen, intellectual property is taken, confidential information is leaked, or the organization’s reputation is damaged, it is the management staff that will be held accountable and expected to explain why due diligence and due care were not practiced in protecting the company and its resources. These explanations may be given to corporate offices, shareholders, judges, and customers. So it should be management who truly understands how security works within the organization and should be calling the shots from the beginning.
Internet and Web Activities The Internet was established so universities and government organizations could communicate in a more instantaneous manner and share information easily. It not only provided a different communication path, it opened the door to the possibility of mass communication, as well as a new and exciting mechanism that could provide layers of functionality and potential for individuals and businesses all around the world. Communication on the Internet consisted mainly of nongraphical e-mail, news groups, and File Transfer Protocol (FTP) sites to exchange files. When the Hypertext Markup Language (HTML) came to life, people were able to make graphical representations of their concepts and ideas. These sites provided static pages with a small amount of capability to accept information from Internet users through forms and scripts. When entrepreneurs realized the Internet was a new money-making forum for advertising and selling, sites became more abundant, web pages became more complex, and more products and services were offered. Companies started integrating this new communication mechanism into their business model. A game of leapfrog began between telecommunication capabilities, Internet protocols, hardware platforms, and supporting applications. As HTML became more dynamic, web server applications were developed to manage these web pages and the back-end processes. This increased the need for more hard drive space, processing power, and memory accessible to the applications. Protocols evolved and matured to create a more stable and meaningful experience on the Internet. These protocols enabled confidential information to stay secret and provided the necessary level of integrity for data being transmitted. Web servers became more powerful in processing as they offered more functionality to the users. As more sites connected to each other, the Internet led to the development of the World Wide Web. The Web is actually a layer that operates on top of the Internet. The Internet provides the hardware, platforms, and communication mechanisms, whereas the Web provides the abundant software capabilities and functionality. Figure 2-3 illustrates this difference.
ch02.indd 37
10/5/2007 11:45:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
38
Figure 2-3 There is a difference between the Internet and the World Wide Web. The Web is a layer that exists on top of the Internet.
As companies connected their networks to the Internet and brought their services to the Web, they connected to the world in an entirely new way. It is a great marketing tool for a business to enable thousands or millions of people to view its product line, understand its business objectives, and learn about the services it offers. However, this also opens the doors to others who are interested in finding out more about the company’s network topology and applications being used, accessing confidential information, and maybe causing some mayhem here and there in the process. Offering services through the Internet is not the same as offering just another service to a customer base. It can be a powerful and useful move for a company, but if done haphazardly or in a manner that is not clearly thought out, implemented, and maintained, it could end up hurting a company or destroying it. The decisions regarding which software to use, which hardware configurations to make, and which security measures to take to establish a presence on the Web depend on the company, its infrastructure, and the type of data it needs to protect. In the beginning, a web server was just another server on the Internet with a connection outside of the network. Static pages were used, and no real information came from the Internet to the company through this channel. As forms and Common Gateway Interface (CGI) scripts were developed to accept customer information, and as the Internet as a whole became more used and well known, web servers were slowly moved to demilitarized zones (DMZs), the name given to perimeter networks (see Figure 2-4). Unfortunately, many web servers today still live inside of networks, exposing companies to a lot of vulnerabilities.
ch02.indd 38
10/5/2007 11:45:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
39
Figure 2-4 Web servers were eventually moved from the internal network to the DMZ.
As web servers and applications evolved from just showing customers a home page and basic services to providing complete catalogs of products and accepting orders via the Internet, databases had to be brought into the picture. Web servers and databases lived on the same system, or two systems within the DMZ, and provided information to (and accepted information from) the world. This setup worked until more customers were able to access back-end data (within the database) and corrupt it accidentally or intentionally. Companies eventually realized there were not enough layers and protection mechanisms between the users on the Internet and the companies’ important data. Over time this has been improved upon by adding more layers of protective software. NOTE Today, most web-based activities are being carried out with web services with the use of XML, SOAP, and other types of technologies.
This quickly brings us to where we are today. More and more companies are going online and connecting their once closed (or semiclosed) environments to the Internet, which exposes them to threats, vulnerabilities, and problems they have not dealt with before (see Figure 2-5). If a company has static web pages, its web servers and back-end needs are not half as complicated as the companies that accept payments and offer services or hold confidential customer information. Companies that take credit card numbers, allow customers to view their bank account information, and offer products and services over the Web can work in a two-tier or three-tier configuration.
ch02.indd 39
10/5/2007 11:45:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
40 Figure 2-5 Attackers have easy access if databases are directly connected to web servers with no protection mechanisms.
Two-Tier Architecture A two-tier architecture includes a line of web servers that provide customers with a webbased interface and a back-end line of servers or databases that hold data and process the requests. Either the two tiers are within a DMZ, or the back-end database is protected by another firewall. Figure 2-6 shows a two-tier architecture. This architecture is fine for some environments, but for companies that hold bank or credit card information or other sensitive information, a three-tier architecture is usually more appropriate. In the three-tier architecture, the first line consists of a server farm that presents web pages to customers and accepts requests. The farm is usually clustered and redundant, to enable it to handle a heavy load of connections and also balance that load between servers. The back-end tier is basically the same as in the two-tier setup, which has database(s) or host systems. This is where sensitive customer information is held and maintained. The middle tier, absent in the two-tier setup, provides the most interesting functionality. In many cases, this is where the business logic lives and the actual processing of data and requests happens. Figure 2-7 shows the three-tier architecture.
Figure 2-6 A two-tier architecture consists of a server farm and back-end databases.
ch02.indd 40
10/5/2007 11:45:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
41
Figure 2-7 A three-tier architecture is comprised of a front-end server farm, middle servers running middleware software, and back-end databases.
The middle tier is comprised of application servers running some type of middleware, which communicates with the Web (presentation tier) and can be customized for proprietary purposes and needs, or acts basically as another layer of server farms with off-the-shelf products. This layer takes the heavy processing tasks off the front-line servers and provides a layer of protection between the users on the Internet and the sensitive data held in the databases. The middleware is usually made up of components built with object-oriented languages. The objects are the entities that work as binary black boxes by taking in a request, retrieving the necessary information from the backend servers, processing the data, and presenting it back to the requesting entity. Figure 2-8 illustrates how a component works as a black box.
Figure 2-8 Components take requests, pass them on, and process the answer.
ch02.indd 41
10/5/2007 11:45:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
42 The three-tier architecture offers many advantages. Security can be supplied in a more granular fashion if it is applied at different places in the tiers. The first firewall supports a particular security policy and provides the first line of defense. The first tier of web servers accepts only specific requests, can authorize individuals before accepting certain types of requests, and can dictate who gets to make requests to the next tiers. The middle tier can provide security at the component level, which can be very detail-oriented and specific in nature. No requests should be made from the Internet directly to the back-end databases. Several middlemen should have to pass the request, each looking out for specific security vulnerabilities and threats. The back-end databases are then acted upon by the components in the middle tier, not the users themselves. The second firewall should support a different security policy. If an attacker gets through the first firewall, it makes no sense for the second firewall to have the same configurations and settings that were just defeated. This firewall should have different settings that are more restrictive, to attempt to stop a successful intruder at that particular stage.
Database Roles Many times, databases are configured to accept requests only from predefined roles, which ensures that if an intruder makes it all the way through the middleware and to the place that holds the goods, the intruder cannot make a request because she is not a member of one of the predefined roles. This scenario is shown in Figure 2-9. All access attempts are first checked to make sure the requester is a member of a predefined and acceptable group. This means individuals cannot make direct requests to the database, and it is highly unlikely an attacker would be able to figure out the name of the group whose members are permitted to make requests to the database, much less add herself to the group. This is an example of another possible layer of protection available in a tiered approach of web-based operations.
Figure 2-9 This database accepts requests only from members of the operators, accounting, and administrators roles. Other paths are restricted.
ch02.indd 42
10/5/2007 11:45:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
43 CAUTION If group names are obvious or have not been changed from the defaults, extrapolating the group information from a network and making assumptions based on their names may be only a trivial task. Naming conventions should be ambiguous to outsiders and only known to internal security staff. The discussion of Internet and web activities thus far has focused on architectural issues, giving you a broad overview of the network and how large components are configured to secure the network. However, security vulnerabilities usually are found in smaller components and configuration details that are easier to overlook. A great three-tier architecture can be set up by strategically placing firewalls, web servers, and databases to maximize their layers of functionality and security, but an attack can still take place at the protocol, component, or service level of an operating system or application. The types of attacks cover a wide range, from Denial-of-Service (DoS) attacks, spoofing, SQL injections, and buffer overflows to using an application’s own functionality against itself. In other words, the company could set up the right infrastructure, configure the necessary firewalls, disable unnecessary ports and services, and run the IDSs properly, yet still lose control of thousands or millions of credit card numbers to attackers because it failed to update the security patches. This example shows that vulnerabilities can lie at a code level that many network administrators and security professionals are not necessarily aware of. The computer world usually has two main camps: infrastructure and programming. Security vulnerabilities lie in each camp and affect the other, so it’s wise to have a full understanding of an environment and how security breaches can take place through infrastructure and code-based means. So where do the vulnerabilities lie in web-based activities? • Incorrect configurations at the firewall • Web servers that are not hardened or locked down and are open to attacks to the operating system or applications • Middle-tier servers that do not provide the right combination and detailed security necessary to access back-end databases in a controlled manner • Databases and back-end servers that accept requests from any source • Databases and back-end servers that are not protected by another layer of firewalls • Failure to have IDSs watch for suspicious activity • Failure to disable unnecessary protocols and services on computers • Failure to keep the computers patched and up-to-date • Failure to train developers on key security issues • Failure to sanitize data provided by clients through the web forms The list is endless, but one last item is important to touch on that is not approached as much as it should be in security: application and programming security. Security is usually thought of in terms of firewalls, IDSs, and port scanners. However, the vulnerabilities exploited are within the code of the operating systems and applications. If
ch02.indd 43
10/5/2007 11:45:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
44 these problems did not exist in the programming code in the first place, there would be nothing to exploit and no real reason to have firewalls and IDSs. Programming has usually been approached only in terms of how it can provide more functionality to the user, not in how it can protect the system it is installed upon or the data it holds and processes. Attacks and exploits that are taking place today were not even in the minds of the programmers while they were coding their programs a couple of years ago. Thus, they most likely did not think of coding differently and testing for these specific weaknesses. The real security problems companies are dealing with are embedded within the products they purchase and install. Only recently have vendors started to take these issues seriously and think about how programming should be done differently. However, proper techniques and extensive testing add a lot of expense and delay to developing a product, and most vendors are not willing to take on those extra expenses and delays without seeing more profit in the end. They have developed the mindset that it is more profitable to get the product to market quickly and worry about patching problems later, and consumers for the most part have acquiesced to this system. It is really up to the consumer market to demand more-secure products and to buy only the products that have the necessary embedded protection mechanisms and methods. Until then, administrators will spend their days patching systems and applications and adjusting firewall and IDS configurations to thwart new vulnerabilities. They will need to continually update attack signatures, and thus the rat race of trying to outrun hackers will continue.
A Layered Approach Networks have advanced in functionality and complexity. Because vulnerabilities can take place at different layers of an infrastructure, it has been necessary for vendors, developers, administrators, and security professionals to understand these layers and how each should be protected. Often, you hear about a “layered approach” to security. You are supposed to implement different layers of protection to protect networks from different types of attacks. But what does a layered approach really mean? How do you know if you are applying a layered approach? These are excellent questions that should be explored in depth if you are serious about protecting your interior and exterior networks from all possible security compromises and breaches. To protect an environment, you must truly understand the environment, the fixes to be applied, the differences between the numerous vendor applications and hardware variations, and how attacks are actually performed. The road to a secure environment is a winding one, with some bumps, sharp turns, and attacks that lunge out from the dark. However, the most important thing when navigating this road to security is to understand the facets of the adventure and that the road never ends. The description of a layered approach to security can be an abstract and nebulous topic because theory must be represented and implemented in reality. Many times, a layered approach means implementing solutions at different spectrums of the network. The spectrums can range from the programming code, the protocols that are being used, the operating system, and the application configurations, through to user activity and the security program that is supposed to govern all of these issues. A layered ap-
ch02.indd 44
10/5/2007 11:45:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
45 proach presents layers of barriers that an attacker must go through and compromise to get to the sought-after resource. Running antivirus software only on workstations is not a layered approach in battling viruses. Running antivirus software on each workstation, file server, and mail server and applying content filtering via a proxy server is considered a layered approach toward combating viruses. This is just one example of what must take place. How is file access protection provided in a layered approach? If an administrator puts all users in specific groups and dictates what those groups can and cannot do with the company’s files, this is only one layer in the approach. To properly protect file access, the administrator must do the following: • Configure application, file, and Registry access control lists (ACLs) to provide more granularity to users’ and groups’ file permissions • Configure the system default user rights (in a Windows environment) to give certain types of users certain types of rights • Consider the physical security of the environment and the computers, and apply restraints where required • Place users into groups that have implicit permissions necessary to perform their duties and no more • Draft and enforce a strict logon credential policy so that not all users are logging on as the same user • Implement monitoring and auditing of file access and actions to identify any suspicious activity Sound like overkill? It really isn’t. If an administrator makes all users log in using different accounts, applies file and Registry ACLs, configures groups, and monitors audit logs but does not consider physical security, a user could use a USB drive with a simple program to get around all other security barriers. All of these components must work in a synergistic manner to provide a blanket of security that individual security mechanisms could not fulfill on their own.
An Architectural View Once we look at different types of vulnerabilities, attacks, and threats, we find they exist at different layers within a network. This digs into more of the technology of an environment and the complexity of each of these technologies at each layer. This applies to the various protocols, applications, hardware, and security mechanisms that work at one or more of the seven layers of the OSI model. (The OSI model is fully described in Chapter 7.) IP spoofing is an attack at the network layer, ARP attacks happen at the data link layer, traffic sniffing occurs at several layers, and viruses enter through the application layer. If an organization just employs strict password rules and a firewall, this leaves many layers vulnerable to other types of attacks. Organizations often put too much faith in their shiny new firewalls, IDSs, and antivirus software. Once one or more of these solutions are implemented, a false sense of security may lull the IT staff and travel up to management. It is more important to look
ch02.indd 45
10/5/2007 11:45:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
46 at the flow of data in and out of a network and how the applications and devices work together. This is an architectural view, versus a device or application view. Taking an architectural view, you must look at the data flow in and out of the environment, how this data is being accessed, modified, and monitored at different points, and how all the security solutions relate to each other in different situations. The firewall, for instance, is only part of the overall architecture. It is the architecture itself that needs to have an adequate level of security, not just the firewall. A network could either perform as a well-tuned orchestra or as several pieces that play wonderfully by themselves but give you a headache when they are all brought into the same room. Each individual security component could be doing its job by protecting its piece of the network, but the security function may be lost when it is time to interrelate or communicate with another security component. Each environment is dissimilar because of the many variations in installed hardware, software, technologies, and configurations. However, the main differences between environments are the goals each is trying to achieve. A local area network (LAN) provides authentication, resources to its users, and an overall controlled inner atmosphere. A wide area network (WAN) provides connections between users at remote sites through protocol tunneling and access control. An e-commerce arrangement provides a web interface to Internet users, connection to data held on back-end servers, access control, and a different type of authentication from what LANs and WANs use. These diverse goals require different architectures, but can use the same basic security concepts. Because there are particular levels within an environment, as shown in Figure 2-10, different types of attacks can happen at these levels. (Four of the seven layers of the OSI model are shown in Figure 2-10.) The following is a short list of countermeasures, the layers they work at, and the vulnerabilities they protect against: • Application proxy firewall configurations protect at the application layer. These combat a range of attacks, including unauthorized access and packet spoofing. • Network address translation (NAT) works at the network layer. This hides LAN IP addresses and topology. • Shielded twisted pair (STP) cabling works at the physical layer. This helps protect against network eavesdropping and signal interference. • A network intrusion detection sensor monitors network traffic at the network and transport layers for known attack signatures. This identifies known attacks and resets TCP connections if necessary. • IP Security (IPSec), which works at the network layer, is configured for virtual private network (VPN) connections into the perimeter network. This protects against masquerading, data manipulation, and unauthorized access to confidential information via encryption. • Web server configuration provides protection within the application by using different sites for public versus confidential information. This protects against directory hopping and unauthorized access. • Only necessary services and ports are enabled on all perimeter devices, which work at the network and transport layers. This reduces entry points into the network and DoS attacks.
ch02.indd 46
10/5/2007 11:45:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
47 • The mail server uses a store-and-forward method of messaging and runs antivirus software. This protects against viruses and DoS attacks. • Secure Sockets Layer (SSL), which works at the transport layer, is configured at the web sites when customers need to access personal confidential information. This provides confidentiality and data integrity, and protects against masquerading. • A network scanner runs a weekly probe on all perimeter network server ports to identify new vulnerabilities. This protects against new vulnerabilities resulting from configuration changes or additional technologies being added. • A web server uses embedded cryptography within Extensible Markup Language (XML) code and Distributed Component Object Model (DCOM) security. This provides confidentiality of information and restricts components from performing risky actions. • Web servers require valid digital certificates from each other for proper authentication. These protect against session hijacking and masquerading. This list shows a small percentage of the activity that happens at different points of the OSI model and the company’s network. If one or more of the devices or software has incorrect configurations or if the environment is missing one of these components, it could leave an open portal for an attacker to gain entry into the network.
Figure 2-10 A graphical representation of devices and protocols and where they appear within the OSI model
ch02.indd 47
10/5/2007 11:45:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
48 A Layer Missed Many environments do not contain all the devices and components in the previous list of security vulnerabilities and solutions. The following example shows how employing several security mechanisms can seemingly provide a fully secured environment yet leave a small doorway of opportunity available that the clever attacker can take advantage of. A network that has a firewall with packet filtering, a proxy server with content filtering, its public and private DNS records clearly separated, SSL for Internet users, IPSec for VPN connections, and public key infrastructure (PKI), as well as restricted service and port configuration, may seem like a fortified environment, and a network administrator most likely implemented these mechanisms with the best intentions. However, one problem is that it is fortified only for a moment in time. Without a scanning device that probes the environment on a scheduled basis or an IDS that looks out for suspicious activity, the environment could be vulnerable even after the company has spent thousands of dollars to protect it. Technology and business drivers continually change, and so do networks and environments. When you configure a new application, apply a patch, or install a device, the change to the environment could have unpredictable consequences (not to mention the new ways hackers have found to circumvent the original security mechanisms).
Bringing the Layers Together It is not always necessary to purchase the newest security solutions on the market or pay top dollar for the hardware solution instead of buying the cheaper software solution. It is necessary to be aware of where threats can develop and take steps to make sure all your bases are covered. That’s what is meant by a layered approach. In the computer and network world, the complexity of the levels can be a bit overwhelming at times. The most important first step is to understand the environment that needs to be protected. Many times, new IT members enter an environment that was established years ago by another group of people. The environment is continually added on to; it is never stagnant. Usually, there is no up-to-date network diagram because IT’s current daily tasks are time consuming, there is a lack of useful documentation, and no one person understands how the entire network works. This means that when something goes wrong, 80 percent of the effort and time is spent in a chaotic scramble for a solution. It does not need to work this way, and there would be fewer security compromises if this scene were not so common. Instead of looking at updating that old network diagram (or creating a first one) as a boring task, you could approach it as a fact-finding mission for crucial information. Instead of putting down the IT staff after a successful hacker attack, you could change your attitude and think of what new practices need to be employed. New software, patches, and devices should be clearly tested prior to implementation for any unforeseen events. An IDS should be established in potentially vulnerable segments of the network, if not all segments. Security scans to seek out new vulnerabilities should take place regularly, not just when an audit is around the corner. In addition, every security administrator should stay up-to-date on the recent security compromises, be aware of how changes to the network could open a door to clever attackers, and keep those intrusion detection and antivirus signatures current.
ch02.indd 48
10/5/2007 11:45:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
49 Keeping current on network, software, configurations, and education can be overwhelming, but most of us in this line of work love to learn. Being effective in managing security means we will never stop learning.
Politics and Laws George W. Bush appointed a cybersecurity czar for the first time in 2001. This is a strong message that the U.S. government realizes the importance of security, both in the government and in the private sectors. Governments all over the world have started to look at computing, and the security issues that surround it, more seriously over the last few years. There is continual dialogue about transborder issues pertaining to cryptography, what can be encrypted, at what strength, and by whom. Broader issues are also injected when an attack comes from another country that does not regulate such activity or does not consider it to be illegal behavior. Different countries’ legal systems are meeting many unprecedented challenges with regard to computer security. As the Internet brings the world closer together, governments are beginning to reach agreements upon matters pertaining to computers, security, boundaries, and acceptable behavior. One sign of countries attempting to get in step with each other is the acceptance of the Common Criteria (which is discussed at length in Chapter 5). Until the acceptance of the Common Criteria, most countries had their own way of evaluating and testing the security and assurance of a system or device. For instance, the United States has used the Trusted Computer System Evaluation Criteria (TCSEC), which is referred to as the Orange Book. The Canadians have the Canadian Trusted Computer Product Evaluation Criteria (CTCPEC), the Europeans have the Information Technology Security Evaluation Criteria (ITSEC), and other countries have developed their own criteria on how to determine the level of trust to place in the security of particular products and systems. The Common Criteria is an attempt to take the best of all of these methods and provide the world with one way of determining a product’s security and protection level. In other words, it is an attempt to harmonize and standardize using one common tool to measure trust in products and systems. Other than different countries viewing computer security differently, another barrier to proper security is how investigators deal with computer crimes. The courts have been running a continual game of catch-up. The legal system cannot keep ahead of (or even in step with) technology, which it must do if it is going to regulate it effectively and determine who is guilty or innocent. It is hard for a judge or jury to declare who is guilty or innocent in a computer crime because they are not educated on these types of crimes. Investigators have a hard time collecting usable evidence to present in court, and defense lawyers have few cases to cite as precedent where similar acts took place because not many cases exist yet. But more convictions are taking place every year. In addition, these difficulties start with law enforcement, which lacks personnel skilled in computer technology and computer forensics. If a person is accused of a cybercrime, law officers must search for evidence. But what do they search for? Law enforcement personnel do not necessarily know how to dump data from memory into a file or find remnants of data after the criminal has formatted the drive, nor do they necessarily understand how computer crimes take place so they can look for the right clues. Law enforcement must know how to remove evidence from computer systems and drives in a way that does not corrupt the data and that preserves its integrity so it is
ch02.indd 49
10/5/2007 11:45:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
50 admissible in court. They must gain much more computer knowledge and skills to be able to deal with computer crimes. NOTE Law enforcement has greatly increased their skills in identifying and fighting computer crime, but such tech knowledge is not yet pervasive in all departments. For the latest information on these developments, visit www. hightechcrimecops.org. Computers are used in many types of crimes and provide many types of barriers that law enforcement and the courts are not used to dealing with. Data and communication may be encrypted, and there are jurisdiction issues if a crime took place in Europe but originated in North America. Also, much of the communication is spoofed, so law enforcement must know how to track down criminals through binary, hexadecimal, and packet header means. These barriers and issues help criminals who are computer savvy. If they do get caught, many are not prosecuted to the extent they would be if they had committed a crime that the courts were used to dealing with. Even though law enforcement has been lagging behind with the problem of cybercrime, initiatives exist at many levels to try and deal with the problem. Many international organizations, such as the G8, the United Nations, and the European Union, are trying to promote cooperation and harmonization in dealing with global computer crime. The Organization for Economic Co-operation and Development (OECD) is an international group made up of 30 member countries and is actively involved with 70 other countries. This international organization is made up of, and serves, developed countries that accept the principles of a free market and representative democracy. Its purpose is to promote trade and economic growth for member and nonmember nations, and provides intergovernmental discussions on sundry economic and social issues, collecting and publishing information, and providing short-term economic forecasts. The group covers a wide range of topics (education, trade, science and innovation, and so on) that would be more successful if all the countries followed the same standards and marched to the same drumbeat. This is not a governing body, necessarily, that cranks out standards that must be followed, but they do provide guidelines, documentation, advice, and statistics to help the different countries work together so they can all be more successful and fruitful. Many governments use this information to shape their laws and regulations so their nations can prosper nationally and internationally. While the OECD deals with many different issues, the actual OECD Principles address financial stability through proper corporate governance. Unfortunately, there’s not much meat to them, given they are just guidelines, not laws or regulations. The theme of the Principles is proper corporate governance, transparency, adequate accounting, external independent audits, internal company controls, the eradication of conflicts of interest, and so on. The OECD defines the purpose of these principles in the following manner: The OECD Principles of Corporate Governance were endorsed by OECD Ministers in 1999 and have since become an international benchmark for policy makers, investors, corporations and other stakeholders worldwide. They have advanced the corporate governance agenda and provided specific guidance for legislative and regulatory initiatives in both OECD and non-OECD countries. The Financial Stability Forum has designated
ch02.indd 50
10/5/2007 11:45:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 2: Security Trends
51 the Principles as one of the 12 key standards for sound financial systems. The Principles also provide the basis for an extensive programme of cooperation between OECD and non-OECD countries and underpin the corporate governance component of World Bank/ IMF Reports on the Observance of Standards and Codes (ROSC). Thus, think of the OECD Principles as the granddaddy of all corporate governance rules for the world. Different governments have built upon these principles to devise laws and regulations that made sense to their environments, including the U.S., which used them to develop SOX. NOTE The Sarbanes-Oxley Act of 2002 (SOX) is legislation enacted in response to the high-profile Enron, WorldCom, and other financial scandals to protect shareholders and the general public from accounting misdeeds and fraudulent practices in publicly owned companies. Although SOX deals specifically with financial reporting, the OECD Principles have a farther reach because proper corporate governance provides more than just correct financial books. Corporate governance affects the volatility in retirement savings, facilitating access to capital, public savings, investment, market confidence, and so on. SOX focuses on truthful financial statements, whereas the OECD Principles focuses on the processes of corporate governance itself. The central goal of the Principles is to help encourage economic stability and growth. CAUTION You are expected to know about the OECD Principles for the CISSP exam. We will cover them in a later chapter also, but this information is not just “interesting,” it is a “need-to-know.” Tough issues face local police forces, Interpol, international judicial systems, the FBI, the CIA, and other organizations. However, with change comes growth. Governments are developing laws and procedures to effectively deal with computer crimes. Crime-fighting agencies are increasing personnel to include people with technology skills and are requiring computer security in many parts of these organizations.
Education Generally, if a person is considered a security specialist, he must have the interest and discipline to teach himself security issues, go to seminars and conferences all over the world, read stacks of books, and have a wide range of experience in different environments. There has not been a uniform, standardized way of teaching security in vocational schools or universities in the past. Some educational institutions offer security classes in their CIS or MIS programs, and some offer master’s degrees or doctorates in computer security. However, such programs are few and far between. Networking, programming, and engineering are widely taught. Security may be sprinkled in as an elective or not even offered because there has not been a high demand or need for this type of knowledge in the job market. However, computer and information security is gaining in importance, need, and demand. This has caused several schools to offer security classes and programs, and others will probably become available as the job market demands more individuals with this skill set.
ch02.indd 51
10/5/2007 11:45:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
52 NOTE To find out about colleges offering security programs that have met the NSA’s Center of Excellence criteria, visit www.nsa.gov/ia/academia/caeiae.cfm.
Not only do more security courses and programs need to be offered, but business, networking, programming, and engineering classes must integrate security education into them. Security should not be looked upon as an extra component or an option to be added later. It should be interwoven into the code as a program is being developed, and interwoven into the education of our new professionals. It should be an important piece of architecture and engineering, and it should be understood and practiced when networks are being built, added upon, and maintained. Most governments have recognized that education is an important part of protecting their country’s critical infrastructure. Countries have set up criteria for schools to follow, with government grants and subsidiaries awarded as incentives for schools who meet the criteria. If countries want to protect themselves and their resources from computer attacks and cyberattacks, they must provide their citizens with the necessary education.
Summary This chapter has touched on only a few of the exciting things that are happening within the field of computer and information security and has presented the types of damage that can occur if security is not taken seriously. It has been recognized for quite some time that computers, data processing capabilities, and the Internet are extremely important tools for a vast array of reasons, but it has only recently been recognized that securing these items is an important task. This chapter is intended to prepare you for the chapters that follow. Some chapters, or sections within chapters, might seem more interesting than others, but the CISSP certification was developed to ensure that you broaden your horizon when looking at, and dealing with, security issues. Information security would not be as effective if it were not provided with strong physical security. Thus, it is important to know how each part works, and how they overlap and integrate. No part of security would be totally effective if it were not enforced by regulations, laws, and liability responsibilities. The courts and law enforcement agencies are becoming more involved in many issues of computer security, and understanding these issues can help you determine what is acceptable and what is illegal, and how to deal with the issues that fall in between. Each chapter hereafter ends with a section called “Quick Tips.” This section provides a clear-cut bulleted list of items that outlines what is important in the chapter for the CISSP exam. The same is true for the questions at the end of the chapter and on the accompanying CD-ROM; they help you zero in on some of the most critical concepts in the chapter. As stated before, these questions are presented in such a way as to prepare you for the exam. Each type of exam has its own way of asking questions. Novell and Microsoft may give simulations and long-winded, scenario-based questions. Cisco gives short questions that get right to the point. (ISC)2 asks short, cognitive questions and added scenario-based questions to the exam as of 2007. Knowing how the exam is structured will help you achieve the CISSP certification.
ch02.indd 52
10/5/2007 11:45:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CHAPTER
Information Security and Risk Management
3
This chapter presents the following: • Security management responsibilities • Difference between administrative, technical, and physical controls • Three main security principles • Risk management and risk analysis • Security policies • Information classification • Security-awareness training
We hear about viruses causing millions of dollars in damages, hackers from other countries capturing credit card information from financial institutions, web sites of large corporations and governments being defaced for political reasons, and hackers being caught and sent to jail. These are the more exciting aspects of computer security, but realistically these activities are not what the average corporation or security professional must usually deal with when it comes to daily or monthly security tasks. Although viruses and hacking get all the headlines, security management is the core of a company’s business and information security structure.
Security Management Security management includes risk management, information security policies, procedures, standards, guidelines, baselines, information classification, security organization, and security education. These core components serve as the foundation of a corporation’s security program. The objective of security, and a security program, is to protect the company and its assets. A risk analysis identifies these assets, discovers the threats that put them at risk, and estimates the possible damage and potential loss a company could endure if any of these threats becomes real. The results of the risk analysis help management construct a budget with the necessary funds to protect the recognized assets from their identified threats and develop applicable security policies that provide direction for security activities. Security education takes this information to each and every employee within the company so everyone is properly informed and can more easily work toward the same security goals.
53
ch03.indd 53
10/8/2007 1:50:38 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
54 The process of security management is a circular one that begins with the assessment of risks and the determination of needs, followed by the monitoring and evaluation of the systems and practices involved. This is then followed by the promoting of awareness which would involve making all the necessary elements of the organization understand the issues that need to be addressed. The last step is the implementation of policies and controls intended to address the risks and needs first defined. Then the cycle starts all over again. In this way, the process continually evaluates and monitors the security environment of an organization and allows it to adapt and grow to meet the security needs of the environment in which it operates and exists. Security management has changed over the years because networked environments, computers, and the applications that hold information have changed. Information used to be held in a mainframe, which is a more centralized network structure. The mainframe and management consoles used to access and configure the mainframe were placed in a centralized area instead of the distributed networks we see today. Only certain people were allowed access and only a small set of people knew how the mainframe worked, which drastically reduced security risks. Users were able to access information on the mainframe through dumb terminals (they were called this because they had little or no logic built into them). There was not much need for strict security controls to be put into place. However, the computing society did not stay in this type of architecture. Now, most networks are filled with personal computers that have advanced logic and processing power, users know enough about the systems to be dangerous, and the information is not centralized within one “glass house.” Instead, the information lives on servers, workstations, and other networks. Information passes over wires and airways at a rate not even conceived of 10 to 15 years ago. The Internet, extranets (business partner networks), and intranets not only make security much more complex, they make security even more critical. The core network architecture has changed from being a localized, stand-alone computing environment to a distributed computing environment that has increased exponentially with complexity. Although connecting a network to the Internet adds more functionality and services for the users and expands the company’s visibility to the Internet world, it opens the floodgates to potential security risks. Today, a majority of organizations could not function if they were to lose their computers and computing capabilities. Computers have been integrated into the business and individual daily fabric, and their sudden unavailability would cause great pain and disruption. Many of the larger corporations already realize that their data are as much an asset to be protected as their physical buildings, factory equipment, and other physical assets. As networks and environments have changed, so has the need for security. Security is more than just a firewall and a router with an access list; these systems must be managed, and a big part of security is managing the actions of users and the procedures they follow. This brings us to security management practices, which focus on the continuous protection of company assets.
Security Management Responsibilities Okay, who is in charge and why? In the world of security, management’s functions involve determining objectives, scope, policies, priorities, and strategies. Management needs to define a clear scope
ch03.indd 54
10/8/2007 1:50:47 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
55 and, before 100 people run off in different directions trying to secure the environment, determine actual goals expected to be accomplished from a security program. Management also needs to evaluate business objectives, security risks, user productivity, and functionality requirements and objectives. Finally, management must define steps to ensure that all of these issues are accounted for and properly addressed. Many companies look at the business and productivity elements of the equation only and figure that information and computer security fall within the IT administrator’s responsibilities. In these situations, management is not taking computer and information security seriously, the consequence of which is that security will most likely remain underdeveloped, unsupported, underfunded, and unsuccessful. Security needs to be addressed at the highest levels of management. The IT administrator can consult with management on the subject, but the security of a company should not be delegated entirely to the IT or security administrator. Security management relies on properly identifying and valuing a company’s assets, and then implementing security policies, procedures, standards, and guidelines to provide integrity, confidentiality, and availability for those assets. Various management tools are used to classify data and perform risk analysis and assessments. These tools identify vulnerabilities and exposure rates and rank the severity of identified vulnerabilities so that effective countermeasures can be implemented to mitigate risk in a cost-effective manner. Management’s responsibility is to provide protection for the resources it is responsible for and the company overall. These resources come in human, capital, hardware, and informational forms. Management must concern itself with ensuring that a security program is set up that recognizes the threats that can affect these resources and be assured that the necessary protective measures are put into effect. The necessary resources and funding need to be available, and strategic representatives must be ready to participate in the security program. Management must assign responsibility and identify the roles necessary to get the security program off the ground and keep it thriving and evolving as the environment changes. Management must also integrate the program into the current business environment and monitor its accomplishments. Management’s support is one of the most important pieces of a security program. A simple nod and a wink will not provide the amount of support required.
The Top-Down Approach to Security I will be making the rules around here. Response: You are nowhere near the top—thank goodness! When a house is built, the workers start with a blueprint of the structure, then pour the foundation, and then erect the frame. As the building of the house continues, the workers know what the end result is supposed to be, so they add the right materials, insert doors and windows as specified in the blueprints, erect support beams, provide sturdy ceilings and floors, and add the plaster and carpet and smaller details until the house is complete. Then inspectors come in to ensure the structure of the house and the components used to make it are acceptable. If this process did not start with a blueprint and a realized goal, the house could end up with an unstable foundation and doors and windows that don’t shut properly. As a result, the house would not pass inspection—meaning much time and money would have been wasted.
ch03.indd 55
10/8/2007 1:50:47 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
56 Building a security program is analogous to building a house. When designing and implementing a security program, the security professionals must determine the functionality and realize the end result expected. Many times, companies just start locking down computers and installing firewalls without taking the time to understand the overall security requirements, goals, and assurance levels they expect from security as a whole within their environment. The team involved in the process should start from the top with very broad ideas and terms and work its way down to detailed configuration settings and system parameters. At each step, the team should keep in mind the overall security goals so each piece it adds will provide more granularity to the intended goal. This helps the team avoid splintering the main objectives by running in 15 different directions at once. The next step is to develop and implement procedures, standards, and guidelines that support the security policy and identify the security countermeasures and methods to be put into place. Once these items are developed, the security program increases in granularity by developing baselines and configurations for the chosen security controls and methods. If security starts with a solid foundation and develops over time with understood goals and objectives, a company does not need to make drastic changes midstream. The process can be methodical, requiring less time, funds, and resources, and provide a proper balance between functionality and protection. This is not the norm, but with your insight, maybe you can help your company approach security in a more controlled manner. You could provide the necessary vision and understanding of how security should be properly planned and implemented, and how it should evolve in an organized manner, thereby helping the company avoid a result that is essentially a giant heap of disjointed security products, full of flaws. A security program should use a top-down approach, meaning that the initiation, support, and direction come from top management, work their way through middle management, and then reach staff members. In contrast, a bottom-up approach refers to a situation in which the IT department tries to develop a security program without getting proper management support and direction. A bottom-up approach is usually less effective, not broad enough, and doomed to fail. A top-down approach makes sure the people actually responsible for protecting the company’s assets (senior management) are driving the program.
Security Administration and Supporting Controls If no security officer role currently exists, one should be established by management. The security officer role is directly responsible for monitoring a majority of the facets of a security program. Depending on the organization, security needs, and size of the environment, the security administration may consist of one person or a group of individuals who work in a central or decentralized manner. Whatever its size, the security administration requires a clear reporting structure, an understanding of responsibilities, and testing and monitoring capabilities to make sure compromises do not slip in because of a lack of communication or comprehension. Information owners should dictate which users can access their resources and what those users can do with those resources after they access them. The security administra-
ch03.indd 56
10/8/2007 1:50:48 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
57 tion’s job is to make sure these objectives are implemented. The following controls should be utilized to achieve management’s security directives: • Administrative controls These include the developing and publishing of policies, standards, procedures, and guidelines; risk management; the screening of personnel; conducting security-awareness training; and implementing change control procedures. • Technical controls (also called logical controls) These consist of implementing and maintaining access control mechanisms, password and resource management, identification and authentication methods, security devices, and the configuration of the infrastructure. • Physical controls These entail controlling individual access into the facility and different departments, locking systems and removing unnecessary floppy or CD-ROM drives, protecting the perimeter of the facility, monitoring for intrusion, and environmental controls. Figure 3-1 illustrates how the administrative, technical, and physical controls work together to provide the necessary level of protection. The information owner (also called the data owner) is usually a senior executive within the management group of the company, or the head of a specific department. The information owner has the corporate responsibility for data protection and would be the one held liable for any negligence when it comes to protecting the company’s information assets. The person who holds this role is responsible for assigning classifications to information and dictating how the data should be protected. If the information owner does not lay out the foundation of data protection and ensure the directives are being enforced, she would be violating the due care concept.
Figure 3-1 Administrative, technical, and physical controls should work in a synergistic manner to protect a company’s assets.
ch03.indd 57
10/8/2007 1:50:48 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
58 NOTE Due care is a legal term and concept used to help determine liability in a court of law. If someone is practicing due care, they are acting responsibly and will have a lower probability of being found negligent and liable if something bad takes place. By having a security administration group, a company ensures it does not lose focus on security and that it has a hierarchical structure of responsibility in place. The security officer’s job is to ensure that management’s security directives are fulfilled, not to construct those directives in the first place. There should be a clear communication path between the security administration group and senior management to make certain the security program receives the proper support and ensure management makes the decisions. Too often, senior management is extremely disconnected from security issues, despite the fact that when a serious security breach takes place, senior management must explain the reasons to business partners, shareholders, and the public. After this humbling experience, the opposite problem tends to arise—senior management becomes too involved. A healthy relationship between the security administration group and senior management should be developed from the beginning, and communication should easily flow in both directions.
An Example of Security Management Anyone who has been involved with a security initiative understands it involves a balancing act between securing an environment and still allowing the necessary level of functionality so that productivity is not affected. A common scenario that occurs at the start of many security projects is that the individuals in charge of the project know the end result they want to achieve and have lofty ideas of how quick and efficient their security rollout will be, but they fail to consult the users regarding what restrictions will be placed upon them. The users, upon hearing of the restrictions, then inform the project managers they will not be able to fulfill certain parts of their job if the security rollout actually takes place as planned. This usually causes the project to screech to a halt. The project managers then must initialize the proper assessments, evaluations, and planning to see how the environment can be slowly secured and how to ease users and tasks delicately into new restrictions or ways of doing business. Failing to consult users or fully understand business processes during the planning phase causes many headaches and wastes time and money. Individuals who are responsible for security management activities must realize they need to understand the environment and plan properly before kicking off the implementation phase of a security program. Inadequate management can undermine the entire security effort in a company. Among the possible reasons for inadequate management are that management does not fully understand the necessity of security; security is in competition with other management goals; management views security as expensive and unnecessary; or management applies lip service instead of real support to security. Powerful and useful technologies, devices, software packages, procedures, and methodologies are available to
ch03.indd 58
10/8/2007 1:50:48 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
59 provide the exact level of security required, but without proper security management and management support, none of this really matters.
Fundamental Principles of Security Now, what are we trying to accomplish again? Security programs have several small and large objectives, but the three main principles in all programs are availability, integrity, and confidentiality. These are referred to as the AIC triad. The level of security required to accomplish these principles differs per company, because each has its own unique combination of business and security goals and requirements. All security controls, mechanisms, and safeguards are implemented to provide one or more of these principles, and all risks, threats, and vulnerabilities are measured for their potential capability to compromise one or all of the AIC principles. Figure 3-2 illustrates the AIC triad. Some documentation on this topic may reverse the acronym order, calling it the CIA triad, but it still refers to the concepts shown in Figure 3-2.
Availability Emergency! I can’t get to my data! Response: Turn the computer on! The systems and networks should provide adequate capacity in order to perform in a predictable manner with an acceptable level of performance. They should be able to recover from disruptions in a secure and quick manner so productivity is not negatively affected. Single points of failure should be avoided, backup measures should be taken,
Figure 3-2 The AIC triad
ch03.indd 59
10/8/2007 1:50:49 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
60 redundancy mechanisms should be in place when necessary, and the negative effects from environmental components should be prevented. Necessary protection mechanisms must be in place to protect against inside and outside threats that could affect the availability and productivity of the network, systems, and information. Availability ensures reliability and timely access to data and resources to authorized individuals. System availability can be affected by device or software failure. Backup devices should be used and be available to quickly replace critical systems, and employees should be skilled and on hand to make the necessary adjustments to bring the system back online. Environmental issues like heat, cold, humidity, static electricity, and contaminants can also affect system availability. These issues are addressed in detail in Chapter 6. Systems should be protected from these elements, properly grounded electrically, and closely monitored.
Integrity Integrity is upheld when the assurance of the accuracy and reliability of the information and systems is provided, and any unauthorized modification is prevented. Hardware, software, and communication mechanisms must work in concert to maintain and process data correctly and move data to intended destinations without unexpected alteration. The systems and network should be protected from outside interference and contamination. Environments that enforce and provide this attribute of security ensure that attackers, or mistakes by users, do not compromise the integrity of systems or data. When an attacker inserts a virus, logic bomb, or back door into a system, the system’s integrity is compromised. This can, in turn, negatively affect the integrity of information held on the system by way of corruption, malicious modification, or the replacement of data with incorrect data. Strict access controls, intrusion detection, and hashing can combat these threats. Users usually affect a system or its data’s integrity by mistake (although internal users may also commit malicious deeds). For example, a user with a full hard drive may unwittingly delete configuration files under the mistaken assumption that deleting a boot.ini file must be okay because they don’t remember ever using it. Or, for example, a user may insert incorrect values into a data processing application that ends up charging a customer $3,000,000 instead of $300. Incorrectly modifying data kept in databases is another common way users may accidentally corrupt data—a mistake that can have lasting effects. Security should streamline users’ capabilities and give them only certain choices and functionality so errors become less common and less devastating. System-critical files should be restricted from viewing and access by users. Applications should provide mechanisms that check for valid and reasonable input values. Databases should let only authorized individuals modify data, and data in transit should be protected by encryption or other mechanisms.
Confidentiality Confidentiality ensures that the necessary level of secrecy is enforced at each junction of data processing and prevents unauthorized disclosure. This level of confidentiality should prevail while data resides on systems and devices within the network, as it is transmitted, and once it reaches its destination.
ch03.indd 60
10/8/2007 1:50:49 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
61 Attackers can thwart confidentiality mechanisms by network monitoring, shoulder surfing, stealing password files, and social engineering. These topics will be addressed in more depth in later chapters, but briefly, shoulder surfing is when a person looks over another person’s shoulder and watches their keystrokes or views data as it appears on a computer screen. Social engineering is when one person tricks another person into sharing confidential information such as by posing as someone authorized to have access to that information. Social engineering can take many other forms. Indeed, any one-toone communication medium can be used to perform social engineering attacks. Users can intentionally or accidentally disclose sensitive information by not encrypting it before sending it to another person, by falling prey to a social engineering attack, by sharing a company’s trade secrets, or by not using extra care to protect confidential information when processing it. Confidentiality can be provided by encrypting data as it is stored and transmitted, by using network traffic padding, strict access control, and data classification, and by training personnel on the proper procedures. Availability, integrity, and confidentiality are critical principles of security. You should understand their meaning, how they are provided by different mechanisms, and how their absence can negatively affect an environment, all of which help you best identify problems and provide proper solutions. Every solution, whether it be a firewall, consultant, or security program, must be evaluated by its functional requirements and its assurance requirements. Functional requirements evaluation means, “Does this solution carry out the required tasks?” Assurance requirements evaluation means, “How sure are we of the level of protection this solution provides?” Assurance requirements encompass the integrity, availability, and confidentially aspects of the solution.
Security Definitions I am vulnerable and see you as a threat. Response: Good. The words “vulnerability,” “threat,” “risk,” and “exposure” often are used to represent the same thing even though they have different meanings and relationships to each other. It is important to understand each word’s definition, but more important to understand its relationship to the other concepts. A vulnerability is a software, hardware, or procedural weakness that may provide an attacker the open door he is looking for to enter a computer or network and have unauthorized access to resources within the environment. A vulnerability characterizes the absence or weakness of a safeguard that could be exploited. This vulnerability may be a service running on a server, unpatched applications or operating system software, unrestricted modem dial-in access, an open port on a firewall, lax physical security that allows anyone to enter a server room, or nonenforced password management on servers and workstations. A threat is any potential danger to information or systems. The threat is that someone, or something, will identify a specific vulnerability and use it against the company or individual. The entity that takes advantage of a vulnerability is referred to as a threat
ch03.indd 61
10/8/2007 1:50:49 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
62 agent. A threat agent could be an intruder accessing the network through a port on the firewall, a process accessing data in a way that violates the security policy, a tornado wiping out a facility, or an employee making an unintentional mistake that could expose confidential information or destroy a file’s integrity. A risk is the likelihood of a threat agent taking advantage of a vulnerability and the corresponding business impact. If a firewall has several ports open, there is a higher likelihood that an intruder will use one to access the network in an unauthorized method. If users are not educated on processes and procedures, there is a higher likelihood that an employee will make an intentional or unintentional mistake that may destroy data. If an intrusion detection system (IDS) is not implemented on a network, there is a higher likelihood an attack will go unnoticed until it is too late. Risk ties the vulnerability, threat, and likelihood of exploitation to the resulting business impact. An exposure is an instance of being exposed to losses from a threat agent. A vulnerability exposes an organization to possible damages. If password management is lax and password rules are not enforced, the company is exposed to the possibility of having users’ passwords captured and used in an unauthorized manner. If a company does not have its wiring inspected and does not put proactive fire prevention steps into place, it exposes itself to potentially devastating fires. A countermeasure, or safeguard, is put into place to mitigate the potential risk. A countermeasure may be a software configuration, a hardware device, or a procedure that eliminates a vulnerability or reduces the likelihood a threat agent will be able to exploit a vulnerability. Examples of countermeasures include strong password management, a security guard, access control mechanisms within an operating system, the implementation of basic input/output system (BIOS) passwords, and security-awareness training. If a company has antivirus software but does not keep the virus signatures up-todate, this is a vulnerability. The company is vulnerable to virus attacks. The threat is that a virus will show up in the environment and disrupt productivity. The likelihood of a virus showing up in the environment and causing damage is the risk. If a virus infiltrates the company’s environment, then a vulnerability has been exploited and the company is exposed to loss. The countermeasures in this situation are to update the signatures and install the antivirus software on all computers. The relationships among risks, vulnerabilities, threats, and countermeasures are shown in Figure 3-3. Applying the right countermeasure can eliminate the vulnerability and exposure, and thus reduce the risk. The company cannot eliminate the threat agent, but it can protect itself and prevent this threat agent from exploiting vulnerabilities within the environment.
References • NIST Computer Security Resource Center csrc.ncsl.nist.gov • CISSP and SSCP Open Study Guides www.cccure.org • CISSP.com www.cissps.com
ch03.indd 62
10/8/2007 1:50:49 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
63
Figure 3-3 The relationships among the different security components
Order of Concepts The proper order in which to evaluate these concepts as they apply to your own network is threat, exposure, vulnerability, countermeasures, and, lastly, risk. This is because there can be a threat (new SQL attack) but unless your company has the corresponding vulnerability (SQL server with the necessary configuration), the company is not exposed and it is not a vulnerability. If the vulnerability does reside in the environment, then a countermeasure is applied to reduce the risk.
Security Through Obscurity We write all of the sensitive data backwards and upside down to fool the bad guys. An improper understanding about the risks and requirements can lead to all kinds of problems for an organization. Typically, this results in bad security practices. Things such as security through obscurity become common practices that usually have damaging
ch03.indd 63
10/8/2007 1:50:50 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
64 results. The root of the issue here is the lack of understanding about what the Information Age is really like, what kinds of tools malevolent forces have at their disposal, and the resourcefulness of attackers. This lack of understanding typically leads a defender to the most devastating mistake they can make: believing their opponent is less intelligent than they are. This leads to simple and sloppy mistakes and the proliferation of a false sense of security. Included are ideas such as: flaws cannot be exploited if they are not common knowledge; compiled code is more secure than open-source code because people can’t see the code; moving HTTP traffic to port 8088 will provide enough protection; developing personal encryption algorithms will stop the crackers; and if we all wear Elvis costumes, no one can pick us out to conduct social engineering attacks. These are just a few of the kinds of potentially damaging ideas that can result from taking a security-by-obscurity approach. This is a controversial approach and yet is principal in the areas of computer security and cryptography. Reliance on confusion to provide security can be dangerous. Though everyone wants to believe in the innate goodness of their fellow man, no security professional would have a job if this was actually true. In security, a good practice is illustrated by the old saying, “There are only two people in the world I trust: you and me…and I’m not so sure about you.” This is a better attitude to take, because security really can be compromised by anyone, at any time. A layman’s example of security through obscurity is the old practice of putting a spare key under a doormat in case you are locked out of the house. You assume that no one knows about the spare key, and as long as they don’t it can be considered secure. The vulnerability here is that anyone could gain easy access to the house if they have access to that hidden spare key, and the experienced attacker (in this example, a burglar) knows that these kinds of vulnerabilities exist and takes the appropriate steps to seek them out. This is the same thing with other security systems and practices. Setting up confusing or “tricky” countermeasures does not provide the assurance level that a solid, defense-in-depth, security program can. In the world of cryptography, the Kerckhoffs’ principle embodies the ideas against security through obscurity. Back in the 1880s, Mr. Kerckhoffs stated that no algorithm should be kept secret; only the key should be the secret component. His message is to assume that the attacker can figure out your algorithm and its logic, so ensure that the key is properly protected—which the attacker would need to make the algorithm decode sensitive data.
If Not Obscurity, Then What? Throughout the chapters of this book, best practices, open standards, and implementing and maintaining security controls in an effective manner will be discussed. The development of a security program with layers of protection may take more time in the beginning, but in the long run it provides a better chance of keeping your organization out of both the frying pan and the fire.
ch03.indd 64
10/8/2007 1:50:50 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
65
Organizational Security Model My security model is shaped like a pile of oatmeal. Response: Lovely. An organizational security model is a framework made up of many entities, protection mechanisms, logical, administrative, and physical components, procedures, business processes, and configurations that all work together to provide a security level for an environment. Each model is different, but all models work in layers: one layer provides support for the layer above it, and protection for the layer below it. Because a security model is a framework, companies are free to plug in different types of technologies, methods, and procedures to accomplish the necessary protection level for their environment. Figure 3-4 illustrates the pieces that can make up a security model. Effective security requires a balanced approach and application of all security components and procedures. Some security components are technical (access control lists and encryption) and some are nontechnical (physical and administrative, such as developing a security policy and enforcing compliance), but each has an important place within the framework, and if one is missing or incomplete, the whole framework may be affected. A security model has various layers, but it also has different types of goals to accomplish in different timeframes. You might have a goal for yourself today to brush your teeth, run three miles, finish the project you have been working on, and spend time
Figure 3-4 A comprehensive and effective security model has many integrated pieces.
ch03.indd 65
10/8/2007 1:50:50 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
66 with your kids. These are daily goals, or operational goals. You might have midterm goals: to complete your master’s degree, write a book, and get promoted. These take more time and effort and are referred to as tactical goals. Your long-term goals may be to retire at age 55, save enough money to live comfortably, and live on a houseboat. These goals are strategic goals because they look farther into the future. The same thing happens in security planning. Daily goals, or operational goals, focus on productivity and task-oriented activities to ensure that the company functions in a smooth and predictable manner. A midterm goal, or tactical goal, could be to integrate all workstations and resources into one domain so that more central control can be achieved. Long-term goals, or strategic goals, could be to move all the branches from dedicated communication lines to frame relay, implement IPSec virtual private networks (VPNs) for all remote users, and integrate wireless technology with the necessary security measures into the environment. Security planning can be broken down into three different areas: strategic, tactical, and operational. Strategic planning is the plans that fall in line with the business and information technology goals. The goals of strategic planning have a longer or broader horizon and can extend out as far as five years. Strategic planning may include some of the following goals: • Make sure risks are properly understood and addressed. • Ensure compliance with laws and regulations. • Integrate security responsibilities throughout the organization. • Create a maturity model to allow for continual improvement. • Use security as a business achievement to attract more customers. Tactical planning refers to the initiatives and other support that must be implemented in order to reach the broader goals that have been put forth by the strategic planning. In general, the tactical plans are shorter in length or have a shorter planning horizon than those of the strategic plans. And finally, operational planning deals with very specific plans, their deadlines, and goals. This involves hard dates and timelines by which the goals of the plan should be completed, as well as specific directions in how they are to be completed. These goals tend to be more of a short-term or interim nature to mitigate risks until larger tactical or strategic plans can be created and implemented. The following are a couple of examples of operational planning to help you better understand what it is: • Perform security risk assessment. • Do not allow security changes to decrease productivity. • Maintain and implement controls. • Continually scan for vulnerabilities and roll out patches. • Track compliance with policies.
ch03.indd 66
10/8/2007 1:50:50 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
67 This approach to planning is called the planning horizon. A company usually cannot implement all changes at once, and some changes are larger than others. Many times, certain changes cannot happen until other changes take place. If a company wants to implement its own certificate authority and implement a full public key infrastructure (PKI) enterprise-wide, this cannot happen in a week if the company currently works in decentralized workgroups with no domain structure. So, its operational goals would be to keep production running smoothly and make small steps toward readying the environment for a domain structure. Its tactical goal would be to put all workstations and resources into a domain structure, and centralize access control and authentication. Its strategic goal would be to have all workstations, servers, and devices within the enterprise use the PKI to provide authentication, encryption, and more secure communication channels. Security works best if the company’s operational, tactical, and strategic goals are defined and work to support each other, which can be much harder than it sounds.
Security Program Components I have a security policy, so I must have a security program. Response: You have just begun, my friend. Today, organizations, corporations, government agencies, and individuals are more involved in information security than ever before. With more regulations being promulgated by governments, continuing increases in both the number of attacks and the cost of fighting hackers and malware, and increasing dependence upon computing technology, concerns about information security are expanding from IT departments to the board rooms. Most security professionals welcome this shift because it means the decision makers are finally involved and more progress can be made enterprise-wide. Experienced security professionals have always known that technology is just a small portion of overall organizational security. Business people, who are now becoming more responsible and liable for security, are not so thrilled about this shift, however. The common scenario in businesses and organizations is as follows: A CEO and board members eventually are forced to look at information security because of new regulations, because the costs of viruses and attacks have reached a threshold, or because a civil suit has been filed regarding a security breach. The company typically hires a consultant, who tells the CEO and board that they need a security policy and a network assessment. The company usually pays for both to be done and, with that accomplished, believes the company is secure. However, this is a false sense of security, because the company still has no security program. The company then hires a security officer (typically called either a Corporate Security Officer [CSO] or a Corporate Information Security Officer [CISO]). Senior management hires this person so it can delegate all security activities and responsibilities, and get security off of their desk, but fails to give this person any real authority or budget. Then, when security compromises take place, the CSO becomes the sacrificial lamb— because we always need someone to blame.
ch03.indd 67
10/8/2007 1:50:51 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
68 Now, as security professionals, we have three choices for dealing with this common scenario: • Stick our heads in the sand and hope all of this just goes away. • Continue to be frustrated and confused, develop ulcers, and shake our fists at the unfriendly security gods in the sky. • Understand that we, as a society, are in the first basic steps of our evolution in information security and therefore must be committed to learn and practice the industry’s already developed best practices. The Corporate Information Security Officer (CISO) is responsible for having a strong understanding of the business processes and objectives for the organization, and then with that information they must be able to communicate to senior management about the risks that are threatening the organization, and what regulations and requirements the government has imposed that they will need to adhere to and comply with. This information will need to be reported to management through meetings and documentation. They will need to develop and provide security-awareness programs, and understand the business objectives of the organization. They will also need to develop the budget for any of the activities which occur that are related to information security. Other tasks that will fall to the CISO are the development of policies, procedures, baselines, standards, and guidelines. By having access to and an understanding of this material, they can maintain the awareness of threats and vulnerabilities that are emerging and which could potentially impact the organization. Staying abreast of emerging technologies will also provide them valuable information and tools they can implement or consider. Evaluation of responses to security incidents also falls to the CISO, as well as the task of developing a security compliance program and establishing security metrics. Auditors may be used during the evaluation processes and they can be used from both internal and external sources. By fulfilling all of these job responsibilities and requirements, the CISO will be more effective in making sure the security of the organization is working properly and addresses the risks that the business environment may create for it. It is important that the security elements of the organization report as high as possible in the chain of management. This is because with new government regulations and direct business impacts it is vital that there is a limitation on any possible kinds of miscommunication that can potentially occur during the reporting process. It is also important that at whatever level the security elements are reporting to they maintain a strong working relationship that reinforces the credibility and reliability of the security elements. The last thing you want is the credibility of the CISO to come under question when they are reporting on the security of the organization. This is an individual that will be relied upon to properly report about the security status of the organization. This means when the CISO is reporting to the Chief Executive Officer, it will not only reduce any miscommunications, but also ensure that the correct information is being provided to the proper individuals. The CISO will also need to be reporting information to the Information Technology (IT) department as well as reporting to other elements of the organization such as security, the administrative services department, the insurance and risk management department, the legal department, business unit, and the internal audit department.
ch03.indd 68
10/8/2007 1:50:51 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
69 Effective and clear communications between the security elements and the other departments of the organization will go a long way toward enforcing security and mitigating risks.
Security Frameworks The Control Objectives for Information and related Technology (CobiT) is a framework developed by the Information Systems Audit and Control Association (ISACA) and the IT Governance Institute (ITGI). It defines goals for the controls that should be used to properly manage IT and ensure IT maps to business needs. CobiT is broken down into four domains: Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate. Each category drills down into subcategories. For example, Acquire and Implement contains the following subcategories: • Acquire and Maintain Application Software • Acquire and Maintain Technology Infrastructure • Develop and Maintain Procedures • Install and Accredit Systems • Manage Changes So this CobiT domain provides goals and guidance to companies when they purchase, install, test, certify, and accredit IT products. This is very powerful because most companies use an ad hoc and informal approach when making purchases and carrying out procedures. People who are new to CobiT quickly get overwhelmed by it, because it is massive and basically impossible to implement fully even in a 24-month period. Under each of these domains CobiT provides control objectives, control practices, goal indicators, performance indicators, success factors, and maturity models. It lays out a complete roadmap that can be followed to accomplish each of the 34 control objectives this model deals with. Figure 3-5 illustrates how the framework connects business requirements, IT resources, and IT processes. Many IS auditors use this framework as their criteria when determining the efficiency of the implemented controls. This means that if you want to pass an assurance audit, it is a good idea to know and fulfill control objectives in your company as it makes sense. CobiT was derived from the COSO framework, which was developed by the Committee of Sponsoring Organizations of the Treadway Commission in 1985 to deal with fraudulent financial activities and reporting. The COSO framework is made up of the following components: • Control Environment • Management’s philosophy and operating style • Company culture as it pertains to ethics and fraud • Risk Assessment • Establishment of risk objectives • Ability to manage internal and external change
ch03.indd 69
10/8/2007 1:50:51 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
70 Figure 3-5 CobiT components
• Control Activities • Policies, procedures, and practices put in place to mitigate risk • Information and Communication • Structure that ensures that the right people get the right information at the right time • Monitoring • Detecting and responding to control deficiencies COSO is a model for corporate governance and CobiT is a model for IT governance. COSO deals more at the strategic level while CobiT focuses more at the operational level. You can think of CobiT as a way to meet many of the COSO objectives, but only from the IT perspective. COSO deals with non-IT items also, as in company culture, financial accounting principles, board of director responsibility, and internal communication structures. COSO is an acronym for the Committee of Sponsoring Organizations of the Treadway Commission, and was formed in 1985 to provide sponsorship for the National Commission on Fraudulent Financial Reporting, an organization that studies deceptive financial reports and what elements lead to them. Developing and rolling out a security program is not as difficult as many organizations make it out to be, but it is new to them and new things are usually scary and confusing. This is why they should turn to standards and industry best practices, which provide the guidance and recipe for how to set up and implement a full security program.
ch03.indd 70
10/8/2007 1:50:51 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
71 Confusion and Security Today, many business-oriented people who are not security professionals are responsible for rolling out security programs and solutions. Without proper education and training on these matters, companies end up wasting much time and money.
“Implement port authentication, an IPSec VPN, a trusted front end, and intrusion prevention.”
“To prevent a trusted front end we need to use IPSec to protect against port authentication.”
The most commonly used standard is ISO 17799, which was derived from the de facto standard: British Standard 7799 (BS7799). It is an internationally recognized Information Security Management Standard that provides high-level conceptual recommendations on enterprise security. The British Standard actually has two parts: BS7799 Part 1, which outlines control objectives and a range of controls that can be used to meet those objectives; and BS7799 Part II, which outlines how a security program can be set up and maintained. BS7799 Part II also served as a baseline that organizations could be certified against. An organization would choose to be certified against the ISO 17799 standard to provide confidence to their customer base and partners and be used as a marketing tool. To become certified, an authorized third party would evaluate the organization against the requirements in ISO 17799 Part II. The organization could be certified against all of ISO 17799 Part II or just a portion of the standard. While there has been plenty of controversy regarding the benefits and drawbacks of ISO 17799, it is the agreed upon mechanism to describe security processes, and is the benchmark we use to indicate a “correct infrastructure.” It is made up of ten domains, which are very close to the CISSP Common Body of Knowledge (CBK). The ISO 17799 domains are as follows: • Information security policy for the organization Map of business objectives to security, management’s support, security goals, and responsibilities. • Creation of information security infrastructure Create and maintain an organizational security structure through the use of a security forum, a security officer, defining security responsibilities, authorization processes, outsourcing, and independent reviews.
ch03.indd 71
10/8/2007 1:50:52 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
72 • Asset classification and control Develop a security infrastructure to protect organizational assets through accountability and inventory, classification, and handling procedures. • Personnel security Reduce risks that are inherent in human interaction by screening employees, defining roles and responsibilities, training employees properly, and documenting the ramifications of not meeting expectations. • Physical and environmental security Protect the organization’s assets by properly choosing a facility location, erecting and maintaining a security perimeter, implementing access control, and protecting equipment. • Communications and operations management Carry out operations security through operational procedures, proper change control, incident handling, separation of duties, capacity planning, network management, and media handling. • Access control Control access to assets based on business requirements, user management, authentication methods, and monitoring. • System development and maintenance Implement security in all phases of a system’s lifetime through development of security requirements, cryptography, integrity, and software development procedures. • Business continuity management Counter disruptions of normal operations by using continuity planning and testing. • Compliance Comply with regulatory, contractual, and statutory requirements by using technical controls, system audits, and legal awareness. Now, CobiT and COSO provide the “what is to be achieved,” but not the “how to achieve it.” This is where ITIL and ISO 17799 come in. The Information Technology Infrastructure Library (ITIL) is the de facto standard of best practices for IT service management. ITIL was created because of the increased dependence on information technology to meet business needs. Unfortunately, a natural divide exists between business people and IT people in every organization because they use different terminology and have different focuses within the organization. The lack of a common language and understanding of each other’s domain (business versus IT) has caused many companies to not properly blend their business objectives and IT functions in an effective manner. The results of this lack of blending usually end up generating confusion, miscommunication, missed deadlines, missed opportunities, increased cost in time and labor, and frustration on both the business and technical sides of the house. ITIL is a customizable framework that is provided in a set of books or in an online format. It provides the goals, the general activities necessary to achieve these goals, and the input and output values for each process required to meet these determined goals. Where CobiT defines IT goals, ITIL provides the steps at the process level on how to achieve those goals. Although ITIL has a component that deals with security, its focus is more towards internal service level agreements between the IT department and the “customers” it serves. The customers are usually internal departments.
ch03.indd 72
10/8/2007 1:50:52 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
73 ISO and All of Its Series ISO likes things neat and tidy. It uses different series numbers to represent specific types of standards. For example, the ISO 9000 series is comprised of many standards that deal with quality control. A new series, 27000, is used for assurance and security standards. ISO is moving the 17799 standards to correspond with their current numbering format. ISO 17799:2005 is the newest version of BS7799 Part 1 and ISO/IEC 27001:2005 is the newest version of BS7700 Part II. ISO 27001:2005 provides the steps for setting up and maintaining a security program, while ISO 17799:2005 provides a list of controls that can be used within the framework outlined in ISO 27001:2005. ISO 17799 will be renamed ISO 27002 once all the planets align and it is approved. In the industry (and on the exam), you will most likely see ISO 17799 and ISO 27001. NOTE The technically correct names for the ISO standards listed earlier are ISO/IEC with a following number (ISO/IEC 17799:2005, ISO/IEC 27001:2005, and so on). IEC is the International Electrotechnical Commission, which jointly works with ISO to create global standards. In the industry, and on the exam, you could see the standards presented with or without IEC, but they are still referring to the same standards. Just using ISO is an abbreviation.
References • The ISO 17799 Service and Software Directory www.iso17799software.com • The ISO 17799 Directory www.iso-17799.com • The ISO 17799 Community Portal www.17799.com • ISACA CobiT Framework www.isaca.org • IT Infrastructure Library (ITIL) www.itil.co.uk
Security Governance We have security governance because I said so and it is written in our charter. Now, what is security governance again? Security governance is very similar in nature to corporate and IT governance because there are overlapping functionality and goals among the three. All three work within an organizational structure of a company and have the same goals of helping to ensure the company will survive and thrive—each just has a different focus. As the amount of requirements in corporate governance has increased due to regulations and legislation, there has also been an increased need in security governance as well. This is because as the global marketplace increases, so does the need to comply with the multiple laws and practices of the countries in which they are conducting business. Just as the boards of directors of organizations are being held more and more accountable for the business practices and performance of their organizations, the need for information security
ch03.indd 73
10/8/2007 1:50:53 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
74 governance has become more and more important in ensuring that the proper mechanisms are in place to provide the board of directors, as well as management, with the ability to conduct the proper oversight so as to manage the risks to the organization at levels that are acceptable and limit potential damages. Many very professional and adult sounding definitions of security governance can be found, such as the following issued by the IT Governance Institute in its Board Briefing on IT Governance, 2nd edition. “Governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly.” This definition is absolutely correct, but remains at a high level that is difficult for many of us mere mortals to fully understand or know how to actually carry out. This is more like a strategic policy statement, while the real skill is to properly interpret and transform it into meaningful tactical and operational functions and practices. Security governance is all of the tools, personnel, and business processes necessary to ensure that the security implemented meets the organization’s specific needs. It requires organizational structure, roles and responsibilities, performance measurement, defined tasks, and oversight mechanisms. This definition is not much better, is it? Let’s compare two companies. Company A has an effective security governance program in place and Company B does not. Now, to the untrained eye it would seem as though Companies A and B are equal in their security practices because they both have security policies, procedures, standards, the same security technology controls (firewalls, IDSs, identity management, and so on), and a security team run by a security officer. You may think, “Man, these two companies are on the ball and quite evolved in their security programs.” But if you look closer, you will see some critical differences (listed in Table 3-1). Does the organization you work for look like Company A or Company B? Most organizations today have many of the pieces and parts to a security program (policies, standards, firewalls, security team, IDS, and so on), but the management is not truly involved, and security has not permeated throughout the organization. Instead, organizations have all of these pieces and parts and have a small security team that is responsible for making sure security is properly carried out throughout the whole company—which is close to impossible. If security was just a technology issue, then this security team could properly install, configure, and maintain the products, and the company would get a gold star and pass the audit with flying colors. But that is not how the world of information security works today. It is much more than just technological solutions. Security professionals need to understand that security must be utilized throughout the organization and having several points of responsibility and accountability is critical. Security governance is a coherent system of integrated security components (products, personnel, training, processes, policies, and so on) that exist to ensure the organization survives and hopefully thrives.
ch03.indd 74
10/8/2007 1:50:53 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
75 Company A
Company B
Board members understand that information security is critical to the company and demand to be updated quarterly on security performance and breaches.
Board members do not understand that information security is in their realm of responsibility and focus solely on corporate governance and profits.
CEO, CFO, CIO, and business unit managers participate in a risk management committee that meets each month, and information security is always one topic on the agenda to review.
CEO, CFO, and business unit managers feel as though information security is the responsibility of the CIO, CISO, and IT department and do not get involved.
Executive management sets an acceptable risk level that is the basis for the company’s security policies and all security activities.
CISO took some boilerplate security policies and inserted his company’s name and had the CEO sign them.
Executive management holds business unit managers responsible for carrying out risk management activities for their specific business units.
All security activity takes place within the security department, thus security works within a silo and is not integrated throughout the organization.
Critical business processes are documented along with the risks that are inherent at the different steps within the business processes.
Business processes are not documented and not analyzed for potential risks that can affect operations, productivity, and profitability.
Employees are held accountable for any security breaches they participate in, either maliciously or accidentally.
Policies and standards are developed, but no enforcement or accountability practices have been envisioned or deployed.
Security products, managed services, and consultants are purchased and deployed in an informed manner. They are also constantly reviewed to ensure they are cost-effective.
Security products, managed services, and consultants are purchased and deployed without any real research or performance metrics to be able to determine the return on investment or effectiveness.
The organization is continuing to review its processes, including security, with the goal of continued improvement.
The organization does not analyze its performance for improvement, but continually marches forward and makes similar mistakes over and over again.
Table 3-1 Comparison of Company A and Company B
NOTE It is easier to purchase a security solution than to attempt to change the culture of an organization. Even if the company has the most up-to-date and advanced products on the market, the company cannot achieve the necessary degree of security if the products are being used by untrained, apathetic, and careless employees. Evaluating the culture of an organization is very important when assessing an organization’s security posture. For there to be security governance, there must be something to govern. The collection of the controls that an organization must have in place is collectively referred to as a security program.
ch03.indd 75
10/8/2007 1:50:53 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
76 Security Program Development It is important to understand that a security program has a life cycle that is always continuing, because it should be constantly evaluated and improved upon. The life cycle of any process can be described in different ways. We will use the following steps: 1. Plan and Organize 2. Implement 3. Operate and Maintain 4. Monitor and Evaluate Many organizations do not follow a life cycle approach in developing, implementing, and maintaining their security management program. This is because they do not know how, or they feel as though this approach is cumbersome and a waste of time. The result of not following a life cycle structure usually results in the following: • Written policies and procedures that are not mapped to and supported by security activities • Severe disconnect and confusion between different individuals throughout the organization who are attempting to protect company assets • No way of assessing progress and the return on investment of spending and resource allocation • No way of fully understanding the security program deficiencies, and having a standardized way of improving upon the deficiencies • No assurance of compliance to regulations, laws, or policies • Relying fully on technology for all security solutions • A patchwork of point solutions and no holistic enterprise solution • A “fire alarm” approach to any breaches instead of a calm proactive and detective approach • A false sense of security with an undercurrent of confusion Without setting up a life cycle approach to a security program and the security management that maintains the program, an organization is doomed to treat security as merely another project. Anything treated as a project has a start and stop date, and at the stop date everyone disperses to other projects. Many organizations have had good intentions in their security program kickoffs, but did not implement the proper structure to ensure that security management was an ongoing and continually improving process. The result was a lot of starts and stops over the years and repetitive work that cost more than it should, with diminishing results. The main components of each phase are provided in the following: • Plan and Organize • Establish management commitment • Establish oversight steering committee • Assess business drivers
ch03.indd 76
10/8/2007 1:50:54 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
77 • Carry out a threat profile on the organization • Carry out a risk assessment • Develop security architectures at an organizational, application, network, and component level • Identify solutions per architecture level • Obtain management approval to move forward • Implement • Assign roles and responsibilities • Develop and implement security policies, procedures, standards, baselines, and guidelines • Identify sensitive data at rest and in transit • Implement the following blueprints: • Asset identification and management • Risk management • Vulnerability management • Compliance • Identity management and access control • Change control • Software development life cycle • Business continuity planning • Awareness and training • Physical security • Incident response • Implement solutions (administrative, technical, physical) per blueprint • Develop auditing and monitoring solutions per blueprint • Establish goals, service level agreements (SLAs), and metrics per blueprint • Operate and Maintain • Follow procedures to ensure all baselines are met in each implemented blueprint • Carry out internal and external audits • Carry out tasks outlined per blueprint • Manage service level agreements per blueprint • Monitor and Evaluate • Review logs, audit results, collected metric values, and SLAs per blueprint • Assess goal accomplishments per blueprint • Carry out quarterly meetings with steering committees • Develop improvement steps and integrate into the Plan and Organize phase
ch03.indd 77
10/8/2007 1:50:54 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
78 Many of the items mentioned in the previous list are covered throughout this book. This list was provided to show how all of these items can be rolled out in a sequential and controllable manner. NOTE Various organizations, consulting companies, and security professionals may follow different approaches to setting up a security program, but overall they cover the same topics. Although every organization has different acceptable risk levels, implemented controls, threats, and business drivers, each of the security programs contains basically the same components. Some components are just emphasized more than others based on the company’s business and security needs. Although these models and frameworks are very helpful, they are also very high level. For example, if a framework simply states an organization must secure its data, a great amount of work will be called for. This is where the security professional really rolls up her sleeves, by developing security blueprints. Blueprints are important tools to identify, develop, and design security requirements for specific business needs. These blueprints must be customized to fulfill the organization’s security requirements, which are based on its regulatory obligations, business drivers, and legal obligations. For example, let’s say Company Y has a privacy policy, and their security team has developed standards and procedures pertaining to the privacy strategy the company should follow. The blueprint will then get more granular and lay out the processes and components necessary to meet requirements outlined in the policy, standards, and requirements. This would include at least the following: • • • •
A diagram of the company network Where the sensitive data resides within the network The network segments that the sensitive data transverse The different security solutions in place (VPN, SSL, PGP) that protect the sensitive data • Third-party connections where sensitive data is shared • Security measures in place for third-party connections • And more… The blueprints to be developed and followed depend upon the organization’s business needs. If Company Y uses identity management, there must be a blueprint outlining roles, registration management, authoritative source, identity repositories, single sign-on solutions, and so on. If Company Y does not use identify management, there is no need to build a blueprint for this. Many of the blueprints most organizations need to develop are listed in the following: • • • • •
ch03.indd 78
Security management Business continuity Logging and monitoring Identity management Application integrity
10/8/2007 1:50:54 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
79 • Infrastructure • Asset management • Physical and environmental security • And more… So the blueprint will lay out the security solutions, processes, and components the organization uses to match its security and business needs. These blueprints must be applied to the different business units within the organization. For example, the identity management practiced in each of the different departments should follow the crafted blueprint. Following these blueprints throughout the organization allows for standardization, easier metric gathering, and governance. The blueprints should follow best practices and are commonly mapped to the ISO 17799 framework. Figure 3-6 illustrates where these blueprints come into play when developing a security program. We will dig deeper into blueprints and their components in Chapter 5.
Figure 3-6 Blueprints must map the security and business requirements.
ch03.indd 79
10/8/2007 1:50:55 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
80 Business Requirements: Private Industry vs. Military Organizations Which security model an organization chooses depends on its critical missions and business requirements. Private industry usually has much different missions and requirements than those of the military. Private industry thrives by beating the competition, which is done through marketing and sales, solid management decisions, understanding the target audience, and understanding the flow and ebb of the market. A private-sector business has a better chance of being successful if its data is readily available, so processing order requests and fulfilling service orders can happen quickly and painlessly for the customer. The data also must be accurate to satisfy customers’ needs. Out of the three security services (availability, integrity, and confidentiality), data integrity and availability usually rank higher than confidentiality to most private-sector businesses when compared to military requirements. The military also thrives by beating its competition (other countries or its enemies), which requires proper training, readiness, intelligence, and deployment. Although the private industry does need a degree of secrecy and ensured confidentiality, confidentiality does not play as important a role as it does with a military organization. The military has more critical information that must not fall into the wrong hands; therefore, out of the three main security services, confidentiality is the most important to the military sector. Thus, a military installation must implement a security model that emphasizes confidentiality—commonly more strict than a private-sector organization’s security model.
Information Risk Management Life is full of risk. Risk is the possibility of damage happening, and the ramifications of such damage should it occur. Information risk management (IRM) is the process of identifying and assessing risk, reducing it to an acceptable level, and implementing the right mechanisms to maintain that level. There is no such thing as a 100-percent secure environment. Every environment has vulnerabilities and threats to a certain degree. The skill is in identifying these threats, assessing the probability of them actually occurring and the damage they could cause, and then taking the right steps to reduce the overall level of risk in the environment to what the organization identifies as acceptable. Risks to a company come in different forms, and they are not all computer related. When a company purchases another company, it takes on a lot of risk in the hope this move will increase its market base, productivity, and profitability. If a company increases its product line, this can add overhead, increase the need for personnel and storage facilities, require more funding for different materials, and maybe increase insurance premiums and the expense of marketing campaigns. The risk is that this added overhead might not be matched in sales; thus, profitability will be reduced or not accomplished. When we look at information security, note that a corporation needs to be aware of several types of risk and address them properly. The following items touch on the major categories: • Physical damage Fire, water, vandalism, power loss, and natural disasters
ch03.indd 80
10/8/2007 1:50:55 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
81 • Human interaction Accidental or intentional action or inaction that can disrupt productivity • Equipment malfunction Failure of systems and peripheral devices • Inside and outside attacks Hacking, cracking, and attacking • Misuse of data Sharing trade secrets, fraud, espionage, and theft • Loss of data Intentional or unintentional loss of information through destructive means • Application error Computation errors, input errors, and buffer overflows Threats must be identified, classified by category, and evaluated to calculate their damage potential to the company. Real risk is hard to measure, but prioritizing the potential risks in order of which ones must be addressed first is possible.
Who Really Understands Risk Management? Unfortunately, the answer to this question is that not enough people inside or outside of the security profession really understand risk management. Even though information security is “big business” today, the focus is more on applications, devices, protocols, viruses, and hacking. Although these items all must be considered and weighed in risk management processes, they should be considered small pieces of the overall security puzzle, not the main focus of risk management. Security is now a business issue, but businesses operate to make money, not to just be secure. A business is concerned with security only if potential risks threaten its bottom line, which they can in many ways, such as through the loss of reputation and their customer base after a database of credit card numbers is compromised; through the loss of thousands of dollars in operational expenses from a new computer worm; through the loss of proprietary information as a result of successful company espionage attempts; through the loss of confidential information from a successful social engineering attack; and so on. It is critical that security professionals understand these individual threats, but it is more important they understand how to calculate the risk of these threats and map them to business drivers. Knowing the difference between the definitions of “vulnerability,” “threat,” and “risk” may seem trivial to you, but it is more critical than most people truly understand. A vulnerability scanner can identify dangerous services that are running, unnecessary accounts, and unpatched systems. That is the easy part. But if you have a security budget of only $120,000 and you have a long list of vulnerabilities that need attention, do you have the proper skill to know which ones should be dealt with first? Since you have a finite amount of money and an almost infinite number of vulnerabilities, how do you properly rank the most critical vulnerabilities to ensure that your company is addressing the most critical issues and providing the most return on investment of funds? This is what risk management is all about, and to organizations, corporations, and businesses across the world, it is more important than IDS, ethical hacking, malware, and firewalls. But risk management is not as “sexy” and therefore does not get its necessary attention or implementation.
ch03.indd 81
10/8/2007 1:50:55 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
82 Information Risk Management Policy How do I put all of these risk management pieces together? Response: Let’s check out the policy. Proper risk management requires a strong commitment from senior management, a documented process that supports the organization’s mission, an IRM policy, and a delegated IRM team. The IRM policy should be a subset of the organization’s overall risk management policy (risks to a company include more than just information security issues) and should be mapped to the organizational security policies. The IRM policy should address the following items: • The objectives of the IRM team • The level of risk the company will accept and what is considered an acceptable level of risk • Formal processes of risk identification • The connection between the IRM policy and the organization’s strategic planning processes • Responsibilities that fall under IRM and the roles to fulfill them • The mapping of risk to internal controls • The approach toward changing staff behaviors and resource allocation in response to risk analysis • The mapping of risks to performance targets and budgets • Key indicators to monitor the effectiveness of controls The IRM policy provides the infrastructure for the organization’s security risk management processes and procedures and should address all issues of information security, from personnel screening and the insider threat to physical security and firewalls. It should provide direction on how the IRM team relates information on company risks to senior management and how to properly execute management’s decisions on risk mitigation tasks.
The Risk Management Team Each organization is different in its size, security posture requirements, and security budget. One organization may have one individual responsible for IRM (poor soul) or a team that works in a coordinated manner. The overall goal of the team is to ensure the company is protected in the most cost-effective manner. This goal can be accomplished only if the following components are in place: • An established risk acceptance level provided by senior management • Documented risk assessment processes and procedures • Procedures for identifying and mitigating risks • Appropriate resource and fund allocation from senior management • Contingency plans where assessments indicate they are necessary
ch03.indd 82
10/8/2007 1:50:56 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
83 • Security-awareness training for all staff members associated with information assets • The ability to establish improvement (or risk mitigation) teams in specific areas when necessary • The mapping of legal and regulation compliancy requirements to control and implement requirements • The development of metrics and performance indicators so as to measure and manage various types of risks • The ability to identify and assess new risks as the environment and company changes • The integration of IRM and the organization’s change control process to ensure that changes do not introduce new vulnerabilities Obviously, this list is a lot more than just buying a new shiny firewall and calling the company safe. The IRM team, in most cases, is not made up of employees with the dedicated task of risk management. It consists of people who already have a full-time job in the company and are now tasked with something else. Thus, senior management support is necessary so proper resource allocation can take place. Of course, all teams need a leader, and IRM is no different. One individual should be singled out to run this rodeo and, in larger organizations, this person should be spending 50 to 70 percent of their time in this role. Management must dedicate funds to making sure this person receives the necessary training and risk analysis tools needed to ensure it is a successful endeavor.
Risk Analysis I have determined that our greatest risk is this paperclip. Response: Nice work. Risk analysis, which is really a tool for risk management, is a method of identifying vulnerabilities and threats and assessing the possible damage to determine where to implement security safeguards. Risk analysis is used to ensure that security is cost-effective, relevant, timely, and responsive to threats. Security can be quite complex, even for well-versed security professionals, and it is easy to apply too much security, not enough security, or the wrong security components, and spend too much money in the process without attaining the necessary objectives. Risk analysis helps companies prioritize their risks and shows management the amount of money that should be applied to protecting against those risks in a sensible manner. A risk analysis has four main goals: • Identify assets and their values • Identify vulnerabilities and threats • Quantify the probability and business impact of these potential threats • Provide an economic balance between the impact of the threat and the cost of the countermeasure
ch03.indd 83
10/8/2007 1:50:56 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
84 Risk analysis provides a cost/benefit comparison, which compares the annualized cost of safeguards to the potential cost of loss. A safeguard, in most cases, should not be implemented unless the annualized cost of loss exceeds the annualized cost of the safeguard itself. This means that if a facility is worth $100,000, it does not make sense to spend $150,000 trying to protect it. It is important to figure out what you are supposed to be doing before you dig right in and start working. Anyone who has worked on a project without a properly defined scope can attest to this statement. Before an assessment and analysis is started, the team must carry out project sizing to understand what assets and threats should be evaluated. Most assessments are focused on physical security, technology security, or personnel security. Trying to assess all of them at the same time can be quite an undertaking. One of the team’s tasks is to create a report that details the asset valuations. Senior management should review and accept the lists, and make them the scope of the IRM project. If management determines at this early stage that some assets are not important, the risk assessment team should not spend additional time or resources evaluating those assets. During discussions with management, everyone involved must have a firm understanding of the value of the security AIC triad—availability, integrity, and confidentiality—and how it directly relates to business needs. Management should outline the scope, which most likely will be dictated by regulations and funds. Many projects have run out of funds, and consequently stopped, because proper project sizing was not conducted at the onset of the project. Don’t let this happen to you. A risk analysis helps integrate the security program objectives with the company’s business objectives and requirements. The more the business and security objectives are in alignment, the more successful the two will be. The analysis also helps the company draft a proper budget for a security program and its constituent security components. Once a company knows how much its assets are worth and the possible threats they are exposed to, it can make intelligent decisions about how much money to spend protecting those assets. A risk analysis must be supported and directed by senior management if it is to be successful. Management must define the purpose and scope of the analysis, appoint a team to carry out the assessment, and allocate the necessary time and funds to conduct the analysis. It is essential for senior management to review the outcome of the risk assessment and analysis and act on its findings. After all, what good is it to go through all the trouble of a risk assessment and not react to its findings? Unfortunately, this does happen all too often.
The Risk Analysis Team Each organization has different departments, and each department has its own functionality, resources, tasks, and quirks. For the most effective risk analysis, an organization must build a risk analysis team that includes individuals from many or all departments to ensure that all of the threats are identified and addressed. The team members may be part of management, application programmers, IT staff, systems integrators, and operational managers—indeed, any key personnel from key areas of the organization. This mix is necessary because if the risk analysis team comprises only individuals
ch03.indd 84
10/8/2007 1:50:56 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
85 from the IT department, it may not understand, for example, the types of threats the accounting department faces with data integrity issues, or how the company as a whole would be affected if the accounting department’s data files were wiped out by an accidental or intentional act. Or, as another example, the IT staff may not understand all the risks the employees in the warehouse would face if a natural disaster were to hit, or what it would mean to their productivity and how it would affect the organization overall. If the risk analysis team is unable to include members from various departments, it should, at the very least, make sure to interview people in each department so it fully understands and can quantify all threats. The risk analysis team must also include people who understand the processes that are part of their individual departments, meaning individuals who are at the right levels of each department. This is a difficult task, since managers tend to delegate any sort of risk analysis task to lower levels within the department. However, the people who work at these lower levels may not have adequate knowledge and understanding of the processes that the risk analysis team may need to deal with. When looking at risk, it’s good to keep several questions in mind. Raising these questions helps ensure that the risk analysis team and senior management know what is important. Team members must ask the following: What event could occur (threat event)? What could be the potential impact (risk)? How often could it happen (frequency)? What level of confidence do we have in the answers to the first three questions (certainty)? A lot of this information is gathered through internal surveys, interviews, or workshops. Viewing threats with these questions in mind helps the team focus on the tasks at hand and assists in making the decisions more accurate and relevant.
Risk Ownership One of the more important questions that face people working within an organization is who owns the risk? The answer really isn’t straightforward because it depends upon the situation and what kind of risk is being discussed. Senior management owns the risk present during the operation of the organization, but there may be times when senior management also relies upon data custodians or business units to conduct work and it is during this time that these other elements of the organization also shoulder some of the responsibility of risk ownership. Granted, it always ultimately rests on senior management, but they also must be able to trust that the work they have delegated is being handled in a manner that understands, accepts the existence of, and works to minimize the risks the organization faces in the course of its regular operations.
The Value of Information and Assets If information does not have any value, then who cares about protecting it? The value placed on information is relative to the parties involved, what work was required to develop it, how much it costs to maintain, what damage would result if it were lost or destroyed, what enemies would pay for it, and what liability penalites could be endured. If a company does not know the value of the information and the other assets it is trying to protect, it does not know how much money and time it should spend on protecting them. If you were in charge of making sure Russia does not
ch03.indd 85
10/8/2007 1:50:57 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
86 know the encryption algorithms used when transmitting information to and from U.S. spy satellites, you would use more extreme (and expensive) security measures than you would use to protect your peanut butter and banana sandwich recipe from your nextdoor neighbor. The value of the information supports security measure decisions. The previous examples refer to assessing the value of information and protecting it, but this logic applies toward an organization’s facilities, systems, and resources. The value of the company’s facilities must be assessed, along with all printers, workstations, servers, peripheral devices, supplies, and employees. You do not know how much is in danger of being lost if you don’t know what you have and what it is worth in the first place.
Costs That Make Up the Value An asset can have both quantitative and qualitative measurements assigned to it, but these measurements need to be derived. The actual value of an asset is determined by the cost it takes to acquire, develop, and maintain it. The value is determined by the importance it has to the owners, authorized users, and unauthorized users. Some information is important enough to a company to go through the steps of making it a trade secret. The value of an asset should reflect all identifiable costs that would arise if there were an actual impairment of the asset. If a server cost $4000 to purchase, this value should not be input as the value of the asset in a risk assessment. Rather, the cost of replacing or repairing it, the loss of productivity, and the value of any data that may be corrupted or lost must be accounted for to properly capture the amount the company would lose if the server were to fail for one reason or another. The following issues should be considered when assigning values to assets: • Cost to acquire or develop the asset • Cost to maintain and protect the asset • Value of the asset to owners and users • Value of the asset to adversaries • Value of intellectual property that went into developing the information • Price others are willing to pay for the asset • Cost to replace the asset if lost • Operational and production activities affected if the asset is unavailable • Liability issues if the asset is compromised • Usefulness and role of the asset in the organization Understanding the value of an asset is the first step to understanding what security mechanisms should be put in place and what funds should go toward protecting it. A very important question is how much it could cost the company to not protect the asset. Determining the value of assets may be useful to a company for a variety of reasons, including the following: • To perform effective cost/benefit analyses • To select specific countermeasures and safeguards • To determine the level of insurance coverage to purchase
ch03.indd 86
10/8/2007 1:50:57 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
87 • To understand what exactly is at risk • To conform to due care and comply with legal and regulatory requirements Assets may be tangible (computers, facilities, supplies) or intangible (reputation, data, intellectual property). It is usually harder to quantify the values of intangible assets, which may change over time. How do you put a monetary value on a company’s reputation? Sometimes that’s harder to figure out than a Rubik’s Cube.
Identifying Threats Okay, what should we be afraid of? Earlier, it was stated that the definition of a risk is the probability of a threat agent exploiting a vulnerability to cause harm to a computer, network, or company and the resulting business impact. Many types of threat agents can take advantage of several types of vulnerabilities, resulting in a variety of specific threats, as outlined in Table 3-2, which represents only a sampling of the risks many organizations should address in their risk management programs. Other types of threats can arise in a computerized environment that are much harder to identify than those listed in Table 3-2. These other threats have to do with application and user errors. If an application uses several complex equations to produce results, the threat can be difficult to discover and isolate if these equations are incorrect or if the application is using inputted data incorrectly. This can result in illogical processing and cascading errors as invalid results are passed on to another process. These types of problems can lie within applications’ code and are very hard to identify.
Threat Agent
Can Exploit This Vulnerability
Resulting in This Threat
Virus
Lack of antivirus software
Virus infection
Hacker
Powerful services running on a server
Unauthorized access to confidential information
Users
Misconfigured parameter in the operating system
System malfunction
Fire
Lack of fire extinguishers
Facility and computer damage, and possibly loss of life
Employee
Lack of training or standards enforcement; Lack of auditing
Sharing mission-critical information; Altering data inputs and outputs from data processing applications
Contractor
Lax access control mechanisms
Stealing trade secrets
Attacker
Poorly written application; Lack of stringent firewall settings
Conducting a buffer overflow; Conducting a Denial-of-Service attack
Intruder
Lack of security guard
Breaking windows and stealing computers and devices
Table 3-2 Relationship of Threats and Vulnerabilities
ch03.indd 87
10/8/2007 1:50:57 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
88 User errors, intentional or accidental, are easier to identify by monitoring and auditing user activities. Audits and reviews must be conducted to discover if employees are inputting values incorrectly into programs, misusing technology, or modifying data in an inappropriate manner. Once the vulnerabilities and associated threats are identified, the ramifications of these vulnerabilities being exploited must be investigated. Risks have loss potential, meaning what the company would lose if a threat agent were actually to exploit a vulnerability. The loss may be corrupted data, destruction of systems and/or the facility, unauthorized disclosure of confidential information, a reduction in employee productivity, and so on. When performing a risk analysis, the team also must look at delayed loss when assessing the damages that can occur. Delayed loss has negative effects on a company after a vulnerability is initially exploited. The time period can be anywhere from 15 minutes to years after the exploitation. Delayed loss may include reduced productivity over a period of time, damage to the company’s reputation, reduced income to the company, accrued late penalties, extra expense to get the environment back to proper working conditions, the delayed collection of funds from customers, and so forth. For example, if a company’s web servers are attacked and taken offline, the immediate damage could be data corruption, the man-hours necessary to place the servers back online, and the replacement of any code or components required. The company could lose revenue if it usually accepts orders and payments via its web site. If it takes a full day to get the web servers fixed and back online, the company could lose a lot more sales and profits. If it takes a full week to get the web servers fixed and back online, the company could lose enough sales and profits to not be able to pay other bills and expenses. This would be a delayed loss. If the company’s customers lose confidence in it because of this activity, it could lose business for months or years. This is a more extreme case of delayed loss. These types of issues make the process of properly quantifying losses that specific threats could cause more complex, but they must be taken into consideration to ensure reality is represented in this type of analysis.
Methodologies for Risk Assessment Risk assessment has several different methodologies. Let’s take a look at a couple of them. NIST SP 800-30 and 800-66 are methodologies that can be used by the general public, but their initial creation was designed to be implemented in the healthcare field or other regulated industries. While they were designed to be used by HIPAA clients, they can also be readily adopted and used by other regulated industries. 800-66, specifically, is an example of the kind of methodology that was intended for one regulated industry but that can be adopted and used by another. A second type of risk assessment methodology is called FRAP, which stands for Facilitated Risk Analysis Process. It is designed with the intention of exploring a qualitative risk assessment process in a manner that allows for tests to be conducted on different aspects and variations of the methodology. The intent of this methodology is to provide an organization with the means of deciding what course and actions must be taken in specific circumstances to deal with various issues. This will allow, through the use of a prescreening process, users to deter-
ch03.indd 88
10/8/2007 1:50:57 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
89 mine the areas that really demand and need risk analysis within an organization. FRAP is designed in such a manner that it claims anyone with good facilitation skills will be capable of operating it successfully. Another methodology called OCTAVE was created by Carnegie Mellon University’s Software Engineering Institute. It is a methodology that is intended to be used in situations where people manage and direct the risk evaluation for information security within their company. This places the people that work inside the organization in the power positions as being able to make the decisions regarding what is the best approach for evaluating the security of their organization. This relies on the idea that the people working in these environments best understand what is needed and what kind of risks they are facing. CRAMM is yet another kind of methodology. The acronym stands for CCTA Risk Analysis and Management Method. Though implemented in a manner similar to other methodologies we’ve discussed, it is divided into three segments: countermeasure selection, threat and vulnerability analysis, and valuation and identification of assets. This is intended to deal with the technical aspects of an organization as well as the nontechnical portions. Spanning Tree Analysis is a methodology that develops a tree of all the potential threats and faults that can disrupt a system. Each of the branches is a general topic or category, and as the risk analysis is conducted, the branches that do not apply can be removed (or “pruned” if you care to stay with the tree motif).
Failure and Fault Analysis Failure Modes and Effect Analysis (FMEA) is a method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process. The application of this process to a chronic failure enables the determination of where exactly the failure is most likely to occur. This is very helpful in pinpointing where a vulnerability exists, as well as determining exactly what kind of scope the vulnerability entails—meaning, what would be the secondary ramifications of its exploitation? This in turn makes it not only easier to apply a corrective fix to the vulnerability, but it also allows for a much more effective application of resources to the issue. Think of it as being able to look into the future and locate areas that have the potential for failure, or find vulnerabilities and then apply corrective measures to them before they do become actual liabilities. By following a specific order of steps, the best results can be maximized for a Failure Mode Analysis. 1. Start with a block diagram of a system or control. 2. Consider what happens if each block of the diagram fails. 3. Draw up a table in which failures are paired with their effects and an evaluation of the effects. 4. Correct the design of the system and adjust the table until the system is not known to have unacceptable problems. 5. Have several engineers review the failure modes and effects analysis.
ch03.indd 89
10/8/2007 1:50:58 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
90 Table 3-3 is an example of how an FMEA can be carried out and documented. Although most companies will not have the resources to do this level of detailed work for each and every system and control, it should be carried out on critical functions and systems that can drastically affect the company. NOTE Compliance auditors review the documentation of processes, controls, testing activities, and results. This type of documentation (as long as it is accurate) will illustrate to the auditors how well your organization knows its systems and how you plan to address failures that may take place. It is important to look at a control or system from the micro to the macro level to fully understand where a vulnerability or potential fault resides and the full ramifications of its exploitation. Each computer system is potentially made up of many different time bombs at different layers of its makeup. At the component level, a buffer
Prepared by: Approved by: Date: Revision: Failure Effect on… Item Identification
Function
Failure Mode
Failure Cause
Component or Functional Assembly
Next Higher Assembly
System
Failure Detection Method
IPS application content filter
Inline perimeter protection
Fails to close
Traffic overload
Single point of failure; Denial of service
IPS blocks ingress traffic stream
IPS is brought down
Health check status sent to console and email to security administrator
Central antivirus signature update engine
Push updated signatures to all servers and workstations
Fails to provide adequate, timely protection against malware
Central server goes down
Individual node’s antivirus software is not updated
Network is infected with malware
Central server can be infected and/or infect other systems
Heartbeat status check sent to central console and page network administrator
Fire suppression water pipes
Suppress fire in building 1 in 5 zones
Fails to closed
Water in pipes freeze
None
Building 1 has no suppression agent available
Fire suppression system pipes break
Suppression sensors tied directly into fire system central console
Etc.
Table 3-3 How an FMEA Can Be Carried Out and Documented
ch03.indd 90
10/8/2007 1:50:58 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
91 overflow or dangerous ActiveX control could cause the system to be controlled by an attacker after exploitation. At the program level, an application may not be carrying out proper authorization steps or may not protect its cryptographic keys properly. At the systemwide level, the kernel of an operating system may be flawed, allowing root access to be easily accomplished. Scary stuff can arise at each level, which is why such a detailed approach is necessary. FMEA was first developed for systems engineering. Its purpose is to examine the potential failures in products and the processes involved with them. This approach proved to be successful and has been more recently adapted for use in evaluating of risk management priorities and mitigating known threat-vulnerabilities. The reason for the use of FMEA in assurance risk management is because of the level of detail, variables, and complexity that continues to rise as corporations understand risk at more granular levels. This methodical way of identifying potential pitfalls is coming into play more as the need of risk awareness—down to the tactical and operational levels—continues to expand. While FMEA is most useful as a survey method in order to identify major failure modes in a given system, the method is not as useful in discovering complex failure modes that may be involved in multiple systems or subsystems. A fault tree analysis usually proves to be a more useful approach to identifying failures that can take place within more complex environments and systems. Fault tree analysis follows this general process. First, an undesired effect is taken as the root or top event of a tree of logic. Then, each situation that has the potential to cause that effect is added to the tree as a series of logic expressions. Fault trees are then labeled with actual numbers pertaining to failure probabilities. This is typically done by using computer programs that can calculate the failure probabilities from a fault tree. Figure 3-7 shows a simplistic fault tree and the different logic symbols used to represent what must take place for a specific fault event to occur.
Figure 3-7 Fault tree and logic components
ch03.indd 91
10/8/2007 1:50:58 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
92 When setting up the tree, it must accurately list all the threats or faults that can occur with a system. The branches of the tree can be divided into general categories such as physical threats, networks threats, software threats, Internet threats, and component failure threats. Then, once all possible general categories are in place, you can trim them down and effectively prune the branches from the tree that won’t apply to the system in question. In general, if a system is not connected to the Internet by any means, remove that general branch from the tree. Some of the most common software failure events that can be explored through a fault tree analysis are the following: • False alarms • Insufficient error handling • Sequencing or order • Timing outputs are incorrect • Outputs are valid but not expected Of course, because of the complexity of software and heterogeneous environments, this is a very small list. NOTE Six Sigma is a process improvement methodology. It is the “new and improved” Total Quality Management (TQM) that hit the business sector in the 1980s. Its goal is to improve process quality by using statistical methods of measuring operation efficiency and reducing variation, defects, and waste. Six Sigma is being used in the assurance industry in some instances to measure the success factors of different controls and procedures. So, up to now, we have secured management’s support of the risk analysis, constructed our team so it represents different departments in the company, placed a value on each of the company’s assets, and identified all the possible threats that could affect the assets. We have also taken into consideration all potential and delayed losses the company may endure per asset per threat. We have carried out a failure mode analysis and/or a fault tree analysis to understand the underlying causes of the identified threats. The next step is to use qualitative or quantitative methods to calculate the actual risk the company faces.
Quantitative Risk Analysis The two types of approaches to risk analysis are quantitative and qualitative. Quantitative risk analysis attempts to assign real and meaningful numbers to all elements of the risk analysis process. These elements may include safeguard costs, asset value, business impact, threat frequency, safeguard effectiveness, exploit probabilities, and so on. When all of these are quantified, the process is said to be quantitative. Quantitative risk analysis also provides concrete probability percentages when determining the likelihood of threats. Each element within the analysis (asset value, threat frequency, severity of vul-
ch03.indd 92
10/8/2007 1:50:59 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
93 nerability, impact damage, safeguard costs, safeguard effectiveness, uncertainty, and probability items) is quantified and entered into equations to determine total and residual risks. Purely quantitative risk analysis is not possible because the method attempts to quantify qualitative items, and there are always uncertainties in quantitative values. How do you know how often a vulnerability will be exploited? How do you know the exact monetary business impact that would arise? Quantitative and qualitative approaches have their own pros and cons, and each applies more appropriately to some situations than others. Company management and the risk analysis team, and the tools they decide to use, will determine which approach is best. NOTE Quantitative analysis uses risk calculations that attempt to predict the level of monetary losses and the percentage of chance for each type of threat. Qualitative analysis does not use calculations. Instead, it is more opinion- and scenario-based.
Automated Risk Analysis Methods Collecting all the necessary data that needs to be plugged into risk analysis equations and properly interpreting the results can be overwhelming if done manually. Several automated risk analysis tools on the market can make this task much less painful and, hopefully, more accurate. The gathered data can be reused, greatly reducing the time required to perform subsequent analyses. The risk analysis team can also print out reports and comprehensive graphs to be presented to the management. NOTE Vulnerability assessment and risk analysis tools are available in freeware and commercial versions. Obtaining serious results often requires taking a serious approach to finding the tools that best serve the accuracy of the project. The objective of these tools is to reduce the manual effort of these tasks, perform calculations quickly, estimate future expected losses, and determine the effectiveness and benefits of the security countermeasures chosen. Most automatic risk analysis products port information into a database and run several types of scenarios with different parameters to give a panoramic view of what the outcome will be if different threats come to bear. For example, after such a tool has all the necessary information inputted, it can be rerun several times with different parameters to compute the potential outcome if a large fire were to take place; the potential losses if a virus were to damage 40 percent of the data on the main file server; how much the company would lose if an attacker were to steal all the customer credit card information held in three databases; and so on. Running through the different risk possibilities gives a company a more detailed understanding of which risks are more critical than others, and thus which ones to address first. Figure 3-8 shows a simple ouput of this process.
ch03.indd 93
10/8/2007 1:50:59 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
94
Figure 3-8 A simplistic example showing the severity of current threats versus the probability of them occurring
Steps of a Risk Analysis Many methods and equations can be used when performing a quantitative risk analysis, and many different variables can be inserted into the process. This section covers some of the main steps that should take place in every risk analysis. Step 1: Assign Value to Assets to determine its value:
For each asset, answer the following questions
• What is the value of this asset to the company? • How much does it cost to maintain? • How much does it make in profits for the company? • How much would it be worth to the competition? • How much would it cost to re-create or recover? • How much did it cost to acquire or develop? • How much liability do you face if the asset is compromised? Step 2: Estimate Potential Loss per Threat posed by threats, answer the following questions:
To estimate potential losses
• What physical damage could the threat cause and how much would that cost? • How much loss of productivity could the threat cause and how much would that cost? • What is the value lost if confidential information is disclosed? • What is the cost of recovering from this threat? • What is the value lost if critical devices were to fail? • What is the single loss expectancy (SLE) for each asset, and each threat?
ch03.indd 94
10/8/2007 1:50:59 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
95 This is just a small sample of questions that should be answered. The specific questions will depend upon the types of threats the team uncovers. Step 3: Perform a Threat Analysis Take the following steps to perform a threat analysis: • Gather information about the likelihood of each threat taking place from people in each department. Examine past records and official security resources that provide this type of data. • Calculate the annualized rate of occurrence (ARO), which is how many times the threat can take place in a 12-month period. Step 4: Derive the Overall Annual Loss Potential per Threat the overall loss potential per threat, do the following:
To derive
• Combine potential loss and probability. • Calculate the annualized loss expectancy (ALE) per threat by using the information calculated in the first three steps. • Choose remedial measures to counteract each threat. • Carry out cost/benefit analysis on the identified countermeasures. Step 5: Reduce, Transfer, Avoid, or Accept the Risk For each risk, you can choose whether to reduce, transfer, or accept the risk: • Risk reduction methods • Install security controls and components. • Improve procedures. • Alter the environment. • Provide early detection methods to catch the threat as it’s happening and reduce the possible damage it can cause. • Produce a contingency plan of how business can continue if a specific threat takes place, reducing further damages of the threat. • Erect barriers to the threat. • Carry out security-awareness training. • Risk transfer Buy insurance to transfer some of the risk, for example. • Risk acceptance Live with the risks and spend no more money toward protection. • Risk avoidance Discontinue the activity that is causing the risk. Because we are stepping through a quantitative risk analysis, real numbers are used and calculations are necessary. Single loss expectancy (SLE) and annualized loss expectancy (ALE) were mentioned in the previous analysis steps. The SLE is a dollar amount that is assigned to a single event that represents the company’s potential loss amount if a specific threat were to take place: asset value × exposure factor (EF) = SLE
ch03.indd 95
10/8/2007 1:51:00 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
96 The exposure factor (EF) represents the percentage of loss a realized threat could have on a certain asset. So, for example, if a data warehouse has the asset value of $150,000, it might be estimated that if a fire were to occur, 25 percent of the warehouse would be damaged (and not more, because of a sprinkler system and other fire controls, proximity of a firehouse, and so on), in which case the SLE would be $37,500. This figure is derived to be inserted into the ALE equation: SLE × annualized rate of occurrence (ARO) = ALE
Accepting Risk When a company decides to accept a risk, the decision should be based on cost (countermeasure costs more than potential loss) and an acceptable level of pain (company can live with the vulnerability and threat). But the company must also understand this is a visibility decision, insofar as accepting a specific risk may impact its industry reputation.
The annualized rate of occurrence (ARO) is the value that represents the estimated frequency of a specific threat taking place within a one-year timeframe. The range can be from 0.0 (never) to 1.0 (at least once a year) to greater than one (several times a year) and anywhere in between. For example, if the probability of a flood taking place in Mesa, Arizona is once in 1000 years, the ARO value is 0.001. So, if a fire taking place within a company’s data warehouse facility can cause $37,500 in damages, and the frequency (or ARO) of a fire taking place has an ARO value of 0.1 (indicating once in ten years), then the ALE value is $3750 ($37,500 × 0.1 = $3750). The ALE value tells the company that if it wants to put in controls or safeguards to protect the asset from this threat, it can sensibly spend $3750 or less per year to provide the necessary level of protection. Knowing the real possibility of a threat and how much damage, in monetary terms, the threat can cause is important in determining how much should be spent to try and protect against that threat in the first place. It would not make good business sense for the company to spend more than $3750 per year to protect itself from this threat. Now that we have all these numbers, what do we do with them? Let’s look at the example in Table 3-4, which shows the outcome of a risk analysis. With this data, the company can make intelligent decisions on what threats must be addressed first because of the severity of the threat, the likelihood of it happening, and how much could be lost if the threat were realized. The company now also knows how much money it should spend to protect against each threat. This will result in good business decisions, instead of just buying protection here and there without a clear understanding of the big picture. Because the company has a risk of losing up to $6500 if data is corrupted by virus infiltration, up to this amount of funds can be earmarked toward providing antivirus software and methods to ensure that a virus attack will not happen. We have just explored the ways of performing risk analysis through quantitative means. This method tries to measure the loss in monetary value and assign numeric
ch03.indd 96
10/8/2007 1:51:00 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
97 Asset
Threat
Single Loss Expectancy (SLE)
Annualized Rate of Occurrence (ARO)
Annual Loss Expectancy (ALE)
Facility
Fire
$230,000
0.1
Trade secret
Stolen
$40,000
0.01
File server
Failed
$11,500
0.1
$1150
Data
Virus
$6500
1.0
$6500
Customer credit card info
Stolen
$300,000
3.0
$900,000
$23,000 $400
Table 3-4 Breaking Down How SLE and ALE Values Are Used
sums to each component within the analysis. As stated previously, however, a pure quantitative analysis is difficult to achieve all the time, as well as all the resources required to gather all of the necessary information and values. A quantitative analysis is also considered subjective, not objective, to many people. Although we can look at past events, do our best to assess the value of the assets, and contact agencies that provide frequency estimates of disasters happening in our area, we still cannot say for a fact that we have a 10 percent chance of a fire happening in a year and that it will cause exactly $230,000 in damage. In quantitative risk analysis, we can do our best to provide all the correct information, and by doing so we will come close to the risk values, but we cannot predict the future and how much the future will cost us or the company.
Results of a Risk Analysis The risk analysis team should have clearly defined goals. The following is a short list of what generally is expected from the results of a risk analysis: • Monetary values assigned to assets • Comprehensive list of all possible and significant threats • Probability of the occurrence rate of each threat • Loss potential the company can endure per threat in a 12-month time span • Recommended safeguards, countermeasures, and actions Although this list looks short, there is usually an incredible amount of detail under each bullet item. This report will be presented to senior management, which will be concerned with possible monetary losses and the necessary costs to mitigate these risks. Although the reports should be as detailed as possible, there should be executive abstracts so senior management can quickly understand the overall findings of the analysis. NOTE A risk analysis is considered fully quantitative if all elements of the process are quantified (asset value, business impact, frequency, countermeasure effectiveness, countermeasure costs, probability, and uncertainty).
ch03.indd 97
10/8/2007 1:51:00 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
98 Qualitative Risk Analysis I think we are secure. Response: Great! Let’s all go home. Another method of risk analysis is qualitative, which does not assign numbers and monetary values to components and losses. Instead, qualitative methods walk through different scenarios of risk possibilities and rank the seriousness of the threats and the validity of the different possible countermeasures based on opinions. (A wide sweeping analysis can include hundreds of scenarios.) Qualitative analysis techniques include judgment, best practices, intuition, and experience. Examples of qualitative techniques to gather data are Delphi, brainstorming, storyboarding, focus groups, surveys, questionnaires, checklists, one-on-one meetings, and interviews. The risk analysis team will determine the best technique for the threats that need to be assessed, as well as the culture of the company and individuals involved with the analysis.
Uncertainty In risk analysis, uncertainty refers to the degree to which you lack confidence in an estimate. This is expressed as a percentage, from 0 to 100 percent. If you have a 30 percent confidence level in something, then it could be said you have a 70 percent uncertainty level. Capturing the degree of uncertainty when carrying out a risk analysis is important, because it indicates the level of confidence the team and management should have in the resulting figures.
The team that is performing the risk analysis gathers personnel who have experience and education on the threats being evaluated. When this group is presented with a scenario that describes threats and loss potential, each member responds with their gut feeling and experience on the likelihood of the threat and the extent of damage that may result. A scenario approximately one page in length is written for each major threat. The “expert,” who is most familiar with this type of threat, should review the scenario to ensure it reflects how an actual threat would be carried out. Safeguards that would diminish the damage of this threat are then evaluated, and the scenario is played out for each safeguard. The exposure possibility and loss possibility can be ranked as high, medium, or low on a scale of 1 to 5 or 1 to 10. Once the selected personnel rank the possibility of a threat happening, the loss potential, and the advantages of each safeguard, this information is compiled into a report and presented to management to help it make better decisions on how best to implement safeguards into the environment. The benefits of this type of analysis are that communication must happen among team members to rank the risks, safeguard strengths, and identify weaknesses, and the people who know these subjects the best provide their opinions to management.
ch03.indd 98
10/8/2007 1:51:01 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
99 Let’s look at a simple example of a qualitative risk analysis. The risk analysis team writes a one-page scenario explaining the threat of a hacker accessing confidential information held on the five file servers within the company. The risk analysis team then distributes the one-page scenario to a team of five people (the IT manager, database administrator, application programmer, system operator, and operational manager), who are also given a sheet to rank the threat’s severity, loss potential, and each safeguard’s effectiveness, with a rating of 1 to 5, 1 being the least severe, effective, or probable. Table 3-5 shows the results. This data is compiled and inserted into a report and presented to management. When management is presented with this information, it will see that its staff (or a chosen set of security professionals) feels that purchasing a firewall will protect the company from this threat more than purchasing an intrusion detection system, or setting up a honeypot system. This is the result of looking at only one threat, and management will view the severity, probability, and loss potential of each threat so it knows which threats cause the greatest risk and should be addressed first.
ch03.indd 99
10/8/2007 1:51:01 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
100 Threat = Hacker Accessing Confidential Information
Severity of Threat
Probability of Threat Taking Place
Potential Loss to the Company
Effectiveness of Firewall
Effectiveness of Intrusion Detection System
Effectiveness of Honeypot
IT manager
4
2
4
4
3
2
Database administrator
4
4
4
3
4
1
Application programmer
2
3
3
4
2
1
System operator
3
4
3
4
2
1
Operational manager
5
4
4
4
4
2
Results
3.6
3.4
3.6
3.8
3
1.4
Table 3-5 Example of a Qualitative Analysis
The Delphi Technique The Delphi technique is a group decision method used to ensure each member gives an honest opinion of what he or she thinks the result to a particular threat will be. This avoids a group of individuals feeling pressured to go along with others’ thought processes and enables them to participate in an independent and anonymous way. Each member of the group provides his or her opinion of a certain threat and turns it in to the team that is performing the analysis. The results are compiled and distributed to the group members, who then write down their comments anonymously and return them back to the analysis group. The comments are compiled and redistributed for more comments until a consensus is formed. This method is used to obtain an agreement on cost, loss values, and probabilities of occurrence without individuals having to agree verbally.
Delphi Methods In this text we are describing the consensus Delphi method, where experts help to identify the highest-priority security issues and corresponding countermeasures. Another Delphi method, the Modified Delphi technique, is a silent form of brainstorming. Participants develop ideas individually and silently with no group interaction. The ideas are submitted to a group of decision makers for consideration and action.
Quantitative vs. Qualitative So which method should we use? Each method has its advantages and disadvantages, some of which are outlined in Table 3-6 for purposes of comparison.
ch03.indd 100
10/8/2007 1:51:01 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
101 Attribute
Quantitative
Requires no calculations Requires more complex calculations
Qualitative
X X
Involves high degree of guesswork
X
Provides general areas and indications of risk
X
Is easier to automate and evaluate
X
Used in risk management performance tracking
X
Provides credible cost/benefit analysis
X
Uses independently verifiable and objective metrics
X
Provides the opinions of the individuals who know the processes best Shows clear-cut losses that can be accrued within one year’s time
X X
Table 3-6 Quantitative vs. Qualitative Characteristics
The risk analysis team, management, risk analysis tools, and culture of the company will dictate which approach—quantitative or qualitative—will be used. The goal of either method is to estimate a company’s real risk and rank the severity of the threats so the correct countermeasures can be put into place within a practical budget. Table 3-6 refers to some of the positive aspects of the qualitative and quantitative approaches. However, not everything is always easy. In deciding to use either a qualitative or quantitative approach, the following points might need to be considered:
Qualitative Cons • The assessments and results are basically subjective. • Usually eliminates the opportunity to create a dollar value for cost/benefit discussions. • Difficult to track risk management objectives with subjective measures. • Standards are not available. Each vendor has its own way of interpreting the processes and their results.
Quantitative Cons • Calculations are more complex. Can management understand how these values were derived? • Without automated tools, this process is extremely laborious. • More preliminary work is needed to gather detailed information about environment. • Standards are not available. Each vendor has its own way of interpreting the processes and their results.
ch03.indd 101
10/8/2007 1:51:02 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
102 Protection Mechanisms Okay, so we know we are at risk, and we know the probability of it happening. Now, what do we do? Response: Run. The next step is to identify the current security mechanisms and evaluate their effectiveness. Because a company has such a wide range of threats (not just computer viruses and attackers), each threat type must be addressed and planned for individually. Access control mechanisms used as security safeguards are discussed in Chapter 4. Software applications and data malfunction considerations are covered in Chapters 5 and 11. Site location, fire protection, site construction, power loss, and equipment malfunctions are examined in detail in Chapter 6. Telecommunication and networking issues are analyzed and presented in Chapter 7. Business continuity and disaster recovery concepts are addressed in Chapter 9. All of these subjects have their own associated risks and planning requirements. This section addresses identifying and choosing the right countermeasures for computer systems. It gives the best attributes to look for and the different cost scenarios to investigate when comparing different types of countermeasures. The end product of the analysis of choices should demonstrate why the selected control is the most advantageous to the company.
Countermeasure Selection A security countermeasure, sometimes called a safeguard, must make good business sense, meaning it is cost-effective (its benefit outweighs its cost). This requires another type of analysis: a cost/benefit analysis. A commonly used cost/benefit calculation for a given safeguard is (ALE before implementing safeguard) – (ALE after implementing safeguard) – (annual cost of safeguard) = value of safeguard to the company For example, if the ALE of the threat of a hacker bringing down a web server is $12,000 prior to implementing the suggested safeguard, and the ALE is $3000 after implementing the safeguard, while the annual cost of maintenance and operation of the safeguard is $650, then the value of this safeguard to the company is $8350 each year. The cost of a countermeasure is more than just the amount filled out on the purchase order. The following items should be considered and evaluated when deriving the full cost of a countermeasure: • Product costs • Design/planning costs • Implementation costs • Environment modifications • Compatibility with other countermeasures • Maintenance requirements • Testing requirements
ch03.indd 102
10/8/2007 1:51:02 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
103 • Repair, replacement, or update costs • Operating and support costs • Effects on productivity • Subscription costs • Extra man- or woman-hours for monitoring and responding to alerts • Beer for the headaches that this new tool will bring about WARNING As a consultant, I have repeatedly seen companies purchase new security products without understanding that they will need the staff to maintain those products. Although tools automate tasks, many companies were not even carrying out these tasks before, so they do not save on manhours, but many times require more. Consider an example. Company A decides that to protect many of its resources, purchasing an IDS is warranted. So, the company pays $5500 for an IDS. Is that the total cost? Nope. This software should be tested in an environment that is segmented from the production environment to uncover any unexpected activity. After this testing is complete and the IT group feels it is safe to insert the IDS into its production environment, the IT group must install the monitoring management software, install the sensors, and properly direct the communication paths from the sensors to the management console. The IT group may also need to reconfigure the routers to redirect traffic flow, and it definitely needs to ensure that users cannot access the IDS management console. Finally, the IT group should configure a database to hold all attack signatures, and then run simulations. Costs associated with an IDS alert response should most definitely be considered. Now that Company A has an IDS in place, security administrators may need additional alerting equipment such as pagers or Blackberrys. And then there are the time costs associated with a response to an IDS event. Anyone who has worked in an IT group knows that some adverse reaction almost always takes place in this type of scenario. Network performance can take an unacceptable hit after installing a product, if it is an inline or proactive product. Users may no longer be able to access the Unix server for some mysterious reason. The IDS vendor may not have explained that two more service patches are necessary for the whole thing to work correctly. Staff time will need to be allocated for training, and to respond to all of the positive and false positive alerts the new IDS sends out. So, for example, the cost of this countermeasure could be $5500 for the product, $2500 for training, $3400 for the lab and testing time, $2600 for the loss in user productivity once the product was introduced into production, and $4000 in labor for router reconfiguration, product installation, troubleshooting, and installation of the two service patches. The real cost of this countermeasure is $18,000. If our total potential loss was calculated at $9000, we went over budget by 100 percent when applying this countermeasure for the identified risk. Some of these costs may be hard or impossible to identify before they are incurred, but an experienced risk analyst would account for many of these possibilities.
ch03.indd 103
10/8/2007 1:51:02 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
104 Functionality and Effectiveness of Countermeasures The countermeasure doesn’t work, but it’s pretty. Response: Good enough. The risk analysis team must evaluate the safeguard’s functionality and effectiveness. When selecting a safeguard, some attributes are more favorable than others. Table 3-7 lists and describes attributes that should be considered before purchasing and committing to a security protection mechanism. Characteristic
Description
Modular in nature
It can be installed or removed from an environment without adversely affecting other mechanisms.
Provides uniform protection
A security level is applied to all mechanisms it is designed to protect in a standardized method.
Provides override functionality
An administrator can override the restriction if necessary.
Defaults to least privilege
When installed, it defaults to a lack of permissions and rights instead of installing with everyone having full control.
Independent of safeguards and the asset it is protecting
The safeguard can be used to protect different assets, and different assets can be protected by different safeguards.
Flexibility and security
The more security the safeguard provides, the better. This functionality should come with flexibility, which enables you to choose different functions instead of all or none.
User interaction
Does not panic users.
Clear distinction between user and administrator
A user should have fewer permissions when it comes to configuring or disabling the protection mechanism.
Minimum human intervention
When humans have to configure or modify controls, this opens the door to errors. The safeguard should require the least amount of input from humans as possible.
Asset protection
Asset is still protected even if countermeasure needs to be reset.
Easily upgraded
Software continues to evolve, and updates should be able to happen painlessly.
Auditing functionality
There should be a mechanism that is part of the safeguard that provides minimum and/or verbose auditing.
Minimizes dependence on other components
The safeguard should be flexible and not have strict requirements about the environment into which it will be installed.
Easily useable, acceptable, and tolerated by personnel
If the safeguards provide barriers to productivity or add extra steps to simple tasks, users will not tolerate it.
Must produce output in usable and understandable format
Important information should be presented in a format easy for humans to understand and use for trend analysis.
Must be able to reset safeguard
The mechanism should be able to be reset and returned to original configurations and settings without affecting the system or asset it is protecting.
Table 3-7 Characteristics to Seek When Obtaining Safeguards
ch03.indd 104
10/8/2007 1:51:03 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
105 Characteristic
Description
Testable
The safeguard should be able to be tested in different environments under different situations.
Does not introduce other compromises
The safeguard should not provide any covert channels or backdoors.
System and user performance
System and user performance should not be greatly affected.
Universal application
The safeguard can be implemented across the environment and does not require many, if any, exceptions.
Proper alerting
Thresholds should be able to be set as to when to alert personnel of a security breach, and this type of alert should be acceptable.
Does not affect assets
The assets in the environment should not be adversely affected by the safeguard.
Table 3-7 Characteristics to Seek When Obtaining Safeguards (continued)
Safeguards can provide deterrence attributes if they are highly visible. This tells potential evildoers that adequate protection is in place and that they should move on to an easier target. Although the safeguard may be highly visible, attackers should not be able to discover the way it works, thus enabling them to attempt to modify the safeguard, or know how to get around the protection mechanism. If users know how to disable the antivirus program that is taking up CPU cycles or know how to bypass a proxy server to get to the Internet without restrictions, they will do so.
Putting It Together To perform a risk analysis, a company first decides what assets must be protected and to what extent. It also indicates the amount of money that can go toward protecting specific assets. Next, it must evaluate the functionality of the available safeguards and determine which ones would be most beneficial for the environment. Finally, the company needs to appraise and compare the costs of the safeguards. These steps and the resulting information enable management to make the most intelligent and informed decisions about selecting and purchasing countermeasures. Figure 3-9 illustrates these steps.
We Are Never Done Only by reassessing the risks, on a periodic basis, can a statement of safeguard performance be trusted. If the risk has not changed, and the safeguards implemented are functioning in good order, then it can be said that the risk is being properly mitigated. Regular IRM monitoring will support the information security risk ratings. Vulnerability analysis and continued asset identification and valuation are also important tasks of risk management monitoring and performance. The cycle of continued risk analysis is a very important part of determining whether the safeguard controls that have been put in place are appropriate and necessary to safeguard the assets and environment.
ch03.indd 105
10/8/2007 1:51:03 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
106
Figure 3-9 The main three steps in risk analysis
Total Risk vs. Residual Risk The reason a company implements countermeasures is to reduce its overall risk to an acceptable level. As stated earlier, no system or environment is 100 percent secure, which means there is always some risk left over to deal with. This is called residual risk. Residual risk is different from total risk, which is the risk a company faces if it chooses not to implement any type of safeguard. A company may choose to take on total risk if the cost/benefit analysis results indicate this is the best course of action. For example, if there is a small likelihood that a company’s web servers can be compromised and the necessary safeguards to provide a higher level of protection cost more than the potential loss in the first place, the company will choose not to implement the safeguard, choosing to deal with the total risk. There is an important difference between total risk and residual risk and which type of risk a company is willing to accept. The following are conceptual formulas: threats × vulnerability × asset value = total risk (threats × vulnerability × asset value) × controls gap = residual risk You may also see these concepts illustrated as the following: (threats, vulnerability, and asset value) = total risk total risk – countermeasures = residual risk NOTE The previous formulas are not constructs you can actually plug numbers into. They are instead used to illustrate the relation of the different items that make up risk in a conceptual manner. This means no multiplication or mathematical functions actually take place. It is a “tool” to understand what items are involved when defining either total or residual risk. During a risk assessment, the threats and vulnerabilities are identified. The possibility of a vulnerability being exploited is multiplied by the value of the assets being assessed, which results in the total risk. Once the controls gap (protection the control cannot provide) is factored in, the result is the residual risk. Implementing countermeasures is a way of mitigating risks. Because no company can remove all threats, there will always be some residual risk. The question is what level of risk the company is willing to accept.
ch03.indd 106
10/8/2007 1:51:03 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
107 Handling Risk Now that we know about the risk, what do we do with it? Response: Hide it behind that plant. Once a company knows the amount of total and residual risk it is faced with, it must decide how to handle it. Risk can be dealt with in four basic ways: transfer it, reject it, reduce it, or accept it. Many types of insurance are available to companies to protect their assets. If a company decides the total or residual risk is too high to gamble with, it can purchase insurance, which would transfer the risk to the insurance company. If a company decides to terminate the activity that is introducing the risk, this is known as risk avoidance. For example, if a company allows employees to use instant messaging (IM) there are many risks surrounding this technology. The company could decide not to allow any IM activity by their users because there is not a strong enough business need for its continued use. Discontinuing this service is an example of risk avoidance. Another approach is risk mitigation, where the risk is decreased to a level considered acceptable enough to continue conducting business. Examples of this kind of approach toward handling risk can be seen in many aspects of our lives. The implementation of firewalls, training, and intrusion/detection protection systems represent types of risk mitigation. The last approach is to accept the risk, which means the company understands the level of risk it is faced with, as well as the potential cost of damage, and decides to just live with it and not implement the countermeasure. Many companies will accept risk when the cost/benefit ratio indicates that the cost of the countermeasure outweighs the potential loss value. A crucial issue with risk acceptance is understanding why this is the best approach for a specific situation. Unfortunately, today many people in organizations are accepting risk and not understanding fully what they are accepting. This usually has to do with the immaturity of risk management in the security field and the lack of education and experience in those personnel making risk decisions. When business managers are charged with the responsibility of dealing with risk in their department, most of the time they will accept whatever risk is put in front of them because their real goals pertain to getting a project finished and out the door. They don’t want to be bogged down by this silly and irritating security stuff. Risk acceptance should be based on several factors. For example, is the potential loss lower than the countermeasure? Can the organization deal with the “pain” that will come with accepting this risk? This second consideration is not purely a cost decision, but may entail noncost issues surrounding the decision. For example, if we accept this risk, we must add three more steps in our production process. Does that make sense for us? Or if we accept this risk, more security incidents may arise from it and are we prepared to handle those? The individual, or group, accepting risk must also understand the potential visibility of this decision. Let’s say it has been determined that the company does not need to actually protect customers’ first names, but it does have to protect other items like Social Security numbers, account numbers, and so on. So these current activities are in compliance with the regulations and laws, but what if your customers find out you are not properly protecting their names and they associate such things with identity fraud
ch03.indd 107
10/8/2007 1:51:04 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
108 because of their lack of education on the matter? The company may not be able to handle this potential reputation hit; even if it is doing all it is supposed to be doing. Perceptions of a company’s customer base are not always rooted in fact, but the possibility that customers will move their business to another company is a potential fact your company must comprehend. Figure 3-10 shows how a risk management program can be set up, which ties together all the concepts covered in this section.
References • Risk Management Guide for Information Technology Systems, Recommendations of the National Institute of Standards and Technology http://csrc.nist.gov/ publications/nistpubs/800-30/sp800-30.pdf • Carnegie Mellon Software Engineering Institute www.sei.cmu.edu/ credentials/sepm.html • Handbook of Information Security Management, Domain 3, “Risk Management and Business Continuity Planning,” Micki Krause and Harold F. Tipton, editors (CRC Press LLC) www.cccure.org/Documents/HISM/223-228.html • Security Metrics Guide for Information Technology Systems http://csrc.nist.gov/ publications/nistpubs/800-55/sp800-55.pdf • Threat and Risk Assessment Working Guide (Government of Canada, 1999) www.cse-cst.gc.ca/en/documents/publications/gov_pubs/itsg/itsg04.pdf
Figure 3-10 How a risk management program can be set up
ch03.indd 108
10/8/2007 1:51:04 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
109
Policies, Standards, Baselines, Guidelines, and Procedures The risk assessment is done. Let’s call it a day. Response: Nope, there’s more to do. Computers and the information processed on them usually have a direct relationship with a company’s critical missions and objectives. Because of this level of importance, senior management should make protecting these items a high priority and provide the necessary support, funds, time, and resources to ensure that systems, networks, and information are protected in the most logical and cost-effective manner possible. A comprehensive management approach must be developed to accomplish these goals successfully. This is because everyone within an organization may have a different set of personal values and experiences they bring to the environment with regards to security, and it is important to make sure everyone is regarding the security of the organization at a level that meets the needs of the organization as determined by laws, regulations, requirements, and the goals and needs for the organization that have been determined by risk assessments of the environment of the organization. For a company’s security plan to be successful, it must start at the top level and be useful and functional at every single level within the organization. Senior management needs to define the scope of security and identify and decide what must be protected and to what extent. Management must understand the regulations, laws, and liability issues it is responsible for complying with regarding security and ensure that the company as a whole fulfills its obligations. Senior management also must determine what is expected from employees and what the consequences of noncompliance will be. These decisions should be made by the individuals who will be held ultimately responsible if something goes wrong. But it is a common practice to bring in the expertise of the security officers to collaborate in ensuring that sufficient policies and controls are being implemented to achieve the goals being set and determined by senior management. A security program contains all the pieces necessary to provide overall protection to a corporation and lays out a long-term security strategy. A security program should have security policies, procedures, standards, guidelines, baselines, security-awareness training, an incident response plan, and a compliance program. The human resources and legal departments must be involved in the development and enforcement of some of these elements. The language, level of detail, formality of the policy, and supporting mechanisms should be examined by the policy developers. Security policies, standards, guidelines, and procedures must be developed with a realistic view to be most effective. Highly structured organizations usually follow guidelines in a more uniform way. Less structured organizations may need more explanation and emphasis to promote compliance. The more detailed the rules are, the easier it is to know when one has been violated. However, overly detailed documentation and rules can prove to be more burdensome than helpful. On the other hand, many times, the more formal the rules, the easier they are to enforce. The business type, its culture, and its goals must be evaluated to make sure the proper language is used when writing security documentation.
ch03.indd 109
10/8/2007 1:51:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
110 Security Policy Oh look, this paper tells us what we need to do. I am going to put smiley-face stickers all over it. A security policy is an overall general statement produced by senior management (or a selected policy board or committee) that dictates what role security plays within the organization. A security policy can be an organizational policy, an issue-specific policy, or a system-specific policy. In an organizational security policy, management establishes how a security program will be set up, lays out the program’s goals, assigns responsibilities, shows the strategic and tactical value of security, and outlines how enforcement should be carried out. This policy must address relative laws, regulations, and liability issues, and how they are to be satisfied. The organizational security policy provides scope and direction for all future security activities within the organization. It also describes the amount of risk senior management is willing to accept. The organizational security policy has several important characteristics that must be understood and implemented: • Business objectives should drive the policy’s creation, implementation, and enforcement. The policy should not dictate business objectives. • It should be an easily understood document that is used as a reference point for all employees and management. • It should be developed and used to integrate security into all business functions and processes. • It should be derived from and support all legislation and regulations applicable to the company. • It should be reviewed and modified as a company changes, such as through adoption of a new business model, a merger with another company, or change of ownership. • Each iteration of the policy should be dated and under version control. • The units and individuals who are governed by the policy must have access to the applicable portions and not be expected to have to read all policy material to find direction and answers. • It should be created with the intention of having the policies in place for several years at a time. This will help ensure policies are forward thinking enough to deal with potential changes in any near-future security environments that may arise. • It should use language that is direct and commanding and avoid weaker tones and directives. Words like should or may need to be replaced with shall or must. • The level of professionalism in the presentation of the policies reinforces their importance as well as the need to adhere to them. • It should not contain language that isn’t readily understood by everyone. Use clear and declarative statements that are easy to understand and adopt. • It should be reviewed on a regular basis and adapted to correct incidents that have occurred since the last review and revision of the policies.
ch03.indd 110
10/8/2007 1:51:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
111 A process for dealing with those that choose not to comply with the security policies must be developed and enforced so there is a structured method of response to noncompliance. This establishes a process that others can understand and thus recognize not only what is expected of them, but also what they can expect as a response to their noncompliance.
Why Have Policies in Place? The following is a good summary of the importance of a security policy: • Identifies assets the company considers valuable • Provides authority to the security team and its activities • Provides a reference to review when conflicts pertaining to security arise • States the company’s goal and objectives pertaining to security • Outlines personal responsibility • Helps to prevent unaccounted-for events (surprises) • Defines the scope for the security team and its functions • Outlines incident response responsibilities • Outlines the company’s response to legal, regulatory, and standards of due care It is through these policies that security programs can be set up with a strong foundation and an organized method of response to security issues, as well as expectations for personnel within the organization as to who is in charge during certain kinds of incidents. Different types of security polices can be implemented in an organization. These policies can be adapted to fit the specific needs of their environment. An issue-specific policy, also called a functional implementing policy, addresses specific security issues that management feels need more detailed explanation and attention to make sure a comprehensive structure is built and all employees understand how they are to comply with these security issues. For example, an organization may choose to have an e-mail security policy that outlines what management can and cannot do with employees’ e-mail messages for monitoring purposes, that specifies which e-mail functionality employees can or cannot use, and that addresses specific privacy issues. As a more specific example, an e-mail policy might state that management can read any employee’s e-mail messages that reside on the mail server, but not when they reside on the user’s workstation. The e-mail policy might also state that employees cannot use e-mail to share confidential information or pass inappropriate material, and that they may be subject to monitoring of these actions. Before they use their e-mail clients, employees should be asked to confirm that they have read and understand the e-mail policy, either by signing a confirmation document or clicking Yes in a confirmation dialog box. The policy provides direction and structure for the staff by indicating what they can and cannot do. It informs the users of the expectations of their actions, and it provides liability protection in case an employee cries “foul” for any reason dealing with e-mail use.
ch03.indd 111
10/8/2007 1:51:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
112 NOTE A policy needs to be technology- and solution-independent. It must outline the goals and missions, but not tie the organization to specific ways of accomplishing them. A system-specific policy presents the management’s decisions that are specific to the actual computers, networks, applications, and data. This type of policy may provide an approved software list, which contains a list of applications that may be installed on individual workstations. This policy may describe how databases are to be used and protected, how computers are to be locked down, and how firewalls, IDSs, and scanners are to be employed. Policies are written in broad terms to cover many subjects in a general fashion. Much more granularity is needed to actually support the policy, and this happens with the use of procedures, standards, and guidelines. The policy provides the foundation. The procedures, standards, and guidelines provide the security framework. And the necessary security components, implementations, and mechanisms are used to fill in the framework to provide a full security program and secure infrastructure.
Types of Policies Policies generally fall into one of the following categories: • Regulatory This type of policy ensures that the organization is following standards set by specific industry regulations. It is very detailed and specific to a type of industry. It is used in financial institutions, health care facilities, public utilities, and other governmentregulated industries. • Advisory This type of policy strongly advises employees as to which types of behaviors and activities should and should not take place within the organization. It also outlines possible ramifications if employees do not comply with the established behaviors and activities. This policy type can be used, for example, to describe how to handle medical information, financial transactions, or how to process confidential information. • Informative This type of policy informs employees of certain topics. It is not an enforceable policy, but rather one that teaches individuals about specific issues relevant to the company. It could explain how the company interacts with partners, the company’s goals and mission, and a general reporting structure in different situations.
Standards Some things you just gotta do. Standards refer to mandatory activities, actions, or rules. Standards can give a policy its support and reinforcement in direction. Standards could be internal, or be externally mandated (government laws and regulations). Organizational security standards may specify how hardware and software products are to be used. They can also be used to indicate expected user behavior. They provide
ch03.indd 112
10/8/2007 1:51:05 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
113 a means to ensure that specific technologies, applications, parameters, and procedures are implemented in a uniform manner across the organization. An organizational standard may require that all employees wear their company identification badges at all times, that they challenge unknown individuals about their identity and purpose for being in a specific area, or that they encrypt confidential information. These rules are usually compulsory within a company, and if they are going to be effective, they must be enforced. As stated in an earlier section, tactical and strategic goals are different. A strategic goal can be viewed as the ultimate endpoint, while tactical goals are the steps necessary to achieve it. As shown in Figure 3-11, standards, guidelines, and procedures are the tactical tools used to achieve and support the directives in the security policy, which is considered the strategic goal.
Baselines The term baseline has a couple of definitions. A baseline can refer to a point in time that is used as a comparison for future changes. Once risks have been mitigated, and security put in place, a baseline is formally reviewed and agreed upon, after which, all further comparisons and development are measured against it. A baseline results in a consistent reference point. Let’s say that your doctor has told you that you weigh 400 pounds due to your diet of donuts, pizza, and soda. (This is very frustrating to you because the TV commercial said you could eat whatever you wanted and just take their very expensive pills every day and lose weight.) The doctor tells you that you need to exercise each day and elevate your heart rate to double its normal rate for 30 minutes twice a day. How do you know when you are at double your heart rate? You find out your baseline (regular heart rate) by using one of those arm thingies with a little ball attached. So you start at your baseline and continue to exercise until you have doubled it or die, whichever comes first. Baselines are also used to define the minimum level of protection required. In security, specific baselines can be defined per system type, which indicates the necessary Figure 3-11 Policy establishes the strategic plans, and the lower elements provide the tactical support.
ch03.indd 113
10/8/2007 1:51:06 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
114 settings and the level of protection being provided. For example, a company may stipulate that all accounting systems must meet an Evaluation Assurance Level (EAL) 4 baseline. This means that only systems that have gone through the Common Criteria process and achieved this rating can be used in this department evaluation. Once the systems are properly configured, this is the necessary baseline. When new software is installed, when patches or upgrades are applied to existing software, or when other changes take place to the system, there is a good chance the system may no longer be providing its necessary minimum level of protection (its baseline). Security personnel must assess the systems as changes take place and ensure that the baseline level of security is always being met. If a technician installs a patch on a system and does not ensure the baseline is still being met, there could be new vulnerabilities introduced into the system that will allow attackers easy access to the network. NOTE Baselines that are not technology-oriented should be created and enforced within organizations as well. For example, a company can mandate that all employees must have a badge with a picture ID in view while in the facility at all times. It can also state that visitors must sign in at a front desk and be escorted while in the facility. If these are followed, then this creates a baseline of protection. CAUTION While the term “baseline” is interpreted differently in the industry, you should note that software and hardware configurations are commonly referred to as baselines. Specific configurations will provide the minimum amount of security required. This is the interpretation you will most likely run into on the exam.
Guidelines Guidelines are recommended actions and operational guides to users, IT staff, operations staff, and others when a specific standard does not apply. Guidelines can deal with the methodologies of technology, personnel, or physical security. Life is full of gray areas, and guidelines can be used as a reference during those times. Whereas standards are specific mandatory rules, guidelines are general approaches that provide the necessary flexibility for unforeseen circumstances. A policy might state that access to confidential data must be audited. A supporting guideline could further explain that audits should contain sufficient information to allow for reconciliation with prior reviews. Supporting procedures would outline the necessary steps to configure, implement, and maintain this type of auditing.
Procedures Procedures are detailed step-by-step tasks that should be performed to achieve a certain goal. The steps can apply to users, IT staff, operations staff, security members, and others who may need to carry out specific tasks. Many organizations have written procedures on how to install operating systems, configure security mechanisms, implement access control lists, set up new user accounts, assign computer privileges, audit activities, destroy material, report incidents, and much more.
ch03.indd 114
10/8/2007 1:51:06 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
115 Procedures are considered the lowest level in the policy chain because they are closest to the computers and users (compared to policies) and provide detailed steps for configuration and installation issues. Procedures spell out how the policy, standards, and guidelines will actually be implemented in an operating environment. If a policy states that all individuals who access confidential information must be properly authenticated, the supporting procedures will explain the steps for this to happen by defining the access criteria for authorization, how access control mechanisms are implemented and configured, and how access activities are audited. If a standard states that backups should be performed, then the procedures will define the detailed steps necessary to perform the backup, the timelines of backups, the storage of backup media, and so on. Procedures should be detailed enough to be both understandable and useful to a diverse group of individuals.
Modular Elements Standards, guidelines, and baselines should not be in one large document. Each has a specific purpose and a different audience. A document describing how to be in compliance with a specific regulation may go to the management staff, whereas a detailed procedure on how to properly secure a specific operating system would be directed toward an IT member. Keeping standards, guidelines, and baselines separate and modular in nature helps for proper distribution and updating when necessary.
To tie these items together, let’s walk through an example. A corporation’s security policy indicates that confidential information should be properly protected. It states the issue in very broad and general terms. A supporting standard mandates that all customer information held in databases must be encrypted with the Advanced Encryption Standard (AES) algorithm while it is stored and that it cannot be transmitted over the Internet unless IPSec encryption technology is used. The standard indicates what type of protection is required and provides another level of granularity and explanation. The supporting procedures explain exactly how to implement the AES and IPSec technologies, and the guidelines cover how to handle cases when data is accidentally corrupted or compromised during transmission. All of these work together to provide a company with a security structure.
Implementation Where are the policies that we spent $100,000 to develop? Response: What is a policy again? Unfortunately, security policies, standards, procedures, baselines, and guidelines often are written because an auditor instructed a company to document these items, but then they are placed on a file server and are not shared, explained, or used. To be useful, they must be put into action. No one is going to follow the rules if people don’t know the rules exist. Security policies and the items that support them not only must be developed, but must also be implemented and enforced.
ch03.indd 115
10/8/2007 1:51:06 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
116 To be effective, employees need to know about security issues within these documents; therefore, the policies and their supporting counterparts need visibility. Awareness training, manuals, presentations, newsletters, and legal banners can achieve this visibility. It must be clear that the directives came from senior management and that the full management staff supports these policies. Employees must understand what is expected of them in their actions, behaviors, accountability, and performance. Implementing security policies and the items that support them shows due care by the company and its management staff. Informing employees of what is expected of them and the consequences of noncompliance can come down to a liability issue. If a company fires an employee because he was downloading pornographic material to the company’s computer, the employee may take the company to court and win if the employee can prove he was not properly informed of what was considered acceptable and unacceptable use of company property and what the consequences were. Securityawareness training is covered in later sections, but understand that companies that do not supply this to their employees are not practicing due care and can be held negligent and liable in the eyes of the law.
Due Care and Due Diligence Due care and due diligence are terms used throughout this book. Due diligence is the act of investigating and understanding the risks the company faces. A company practices due care by developing and implementing security policies, procedures, and standards. Due care shows that a company has taken responsibility for the activities that take place within the corporation and has taken the necessary steps to help protect the company, its resources, and employees from possible threats. So, due diligence is understanding the current threats and risks, and due care is implementing countermeasures to provide protection from those threats. If a company does not practice due care and due diligence pertaining to the security of its assets, it can be legally charged with negligence and held accountable for any ramifications of that negligence. The following are some tricks to remember the difference between these two concepts. Due Diligence = Do Detect. Due diligence maps with Do Detect. It is the steps you take to identify the risks using best practices, published standards, and other tools. Due Care = Do Correct. This is what you do to correct the threat identified or to minimize it to an acceptable level of risk.
References • NCSA Security Policies and Procedures www.ncsa.uiuc.edu/UserInfo/ Security/policy/ • SANS Institute Security Policy Project www.sans.org/resources/policies • Information Security Policy World www.information-security-policies-andstandards.com
ch03.indd 116
10/8/2007 1:51:07 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
117
Information Classification My love letter to my dog is top secret. Response: As it should be. Earlier, this chapter touched upon the importance of recognizing what information is critical to a company and assigning a value to it. The rationale behind assigning values to different types of data is that it enables a company to gauge the amount of funds and resources that should go toward protecting each type of data, because not all data has the same value to a company. After identifying all important information, it should be properly classified. A company has a lot of information that is created and maintained. The reason to classify data is to organize it according to its sensitivity to loss, disclosure, or unavailability. Once data are segmented according to their sensitivity level, the company can decide what security controls are necessary to protect different types of data. This ensures that information assets receive the appropriate level of protection, and classifications indicate the priority of that security protection. The primary purpose of data classification is to indicate the level of confidentiality, integrity, and availability protection that is required for each type of data set. Data classification helps ensure data are protected in the most cost-effective manner. Protecting and maintaining data costs money, but it is important to spend this money for the information that actually requires protection. Going back to our very sophisticated example of U.S. spy satellites and the peanut butter and banana sandwich recipe, a company in charge of encryption algorithms used to transmit data to and from U.S. spy satellites would classify this data as top secret and apply complex and highly technical security controls and procedures to ensure it is not accessed in an unauthorized method and disclosed. On the other hand, the sandwich recipe would have a lower classification, and your only means of protecting it might be to not talk about it. Each classification should have separate handling requirements and procedures pertaining to how that data is accessed, used, and destroyed. For example, in a corporation, confidential information may be accessed only by senior management and a select few throughout the company. Accessing the information may require two or more people to enter their access codes. Auditing could be very detailed and its results monitored daily, and paper copies of the information may be kept in a vault. To properly erase this data from the media, degaussing or zeroization procedures may be required. Other information in this company may be classified as sensitive, allowing a slightly larger group of people to view it. Access control on the information classified as sensitive may require only one set of credentials. Auditing happens but is only reviewed weekly, paper copies are kept in locked file cabinets, and the data can be deleted using regular measures when it is time to do so. Then, the rest of the information is marked public. All employees can access it, and no special auditing or destruction methods are required.
Private Business vs. Military Classifications Earlier, we touched on how organizations choose different security models, depending upon the type of organization, its goals, and its objectives. Military organizations are more concerned than most private-sector businesses about not disclosing confidential information. Private-sector businesses are usually more interested in the integrity and availability of data. These different perspectives affect data classification also.
ch03.indd 117
10/8/2007 1:51:07 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
118 To properly implement data classifications, a company must first decide upon the sensitivity scheme it is going to use. One company may choose to use only two layers of classifications, while another company may choose to use more. Table 3-8 explains the types of classifications available. Note that some classifications are used for commercial businesses, whereas others are military classifications. Classification
Definition
Examples
Organizations That Would Use This
Public
• Disclosure is not welcome, but it would not cause an adverse impact to company or personnel.
• How many people are working on a specific project • Upcoming projects
Commercial business
Sensitive
• Requires special precautions to ensure the integrity and confidentiality of the data by protecting it from unauthorized modification or deletion. • Requires higher than normal assurance of accuracy and completeness.
• Financial information • Details of projects • Profit earnings and forecasts
Commercial business
Private
• Personal information for use within a company. • Unauthorized disclosure could adversely affect personnel or the company.
• Work history • Human resources information • Medical information
Commercial business
Confidential
• For use within the company only. • Data exempt from disclosure under the Freedom of Information Act or other laws and regulations. • Unauthorized disclosure could seriously affect a company.
• • • •
Commercial business/ Military
Unclassified
• Data is not sensitive or classified.
• Computer manual and warranty information • Recruiting information
Military
Sensitive but unclassified (SBU)
• Minor secret. • If disclosed, it could cause serious damage.
• Medical data • Answers to test scores
Military
Secret
• If disclosed, it could cause serious damage to national security.
• Deployment plans for troops • Nuclear bomb placement
Military
Top secret
• If disclosed, it could cause grave damage to national security.
• Blueprints of new wartime weapons • Spy satellite information • Espionage data
Military
Trade secrets Health care information Programming code Information that keeps a company competitive
Table 3-8 Commercial Business and Military Data Classification
ch03.indd 118
10/8/2007 1:51:07 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
119 The following shows the levels of sensitivity from the highest to the lowest for commercial business: • Confidential • Private • Sensitive • Public The following shows the levels of sensitivity from the highest to the lowest for the military: • Top secret • Secret • Confidential • Sensitive but unclassified • Unclassified A commonly used classification set employed in the commercial sector is described next: • For official use only Financially sensitive • Proprietary Protects competitive edge • Privileged Ensures conformance with business standards and laws • Private Contains records about individuals It is important to not go overboard and come up with a long list of classifications, which will only cause confusion and frustration for the individuals who will use the system. The classifications should not be too restrictive and detailed-oriented either, because many types of data may need to be classified. Each classification should be unique and separate from the others and not have any overlapping effects. The classification process should also outline how information and applications are controlled and handled through their life cycles (from creation to termination). Once the scheme is decided upon, the company or government agency must develop the criteria it will use to decide what information goes into which classification. The following list shows some criteria parameters an organization may use to determine the sensitivity of data: • The usefulness of data • The value of data
ch03.indd 119
10/8/2007 1:51:08 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
120 • The age of data • The level of damage that could be caused if the data were disclosed • The level of damage that could be caused if the data were modified or corrupted • Legal, regulatory, or contractual responsibility to protect the data • Effects the data has on national security • Who should be able to access the data • Who should maintain the data • Where the data should be kept • Who should be able to reproduce the data • Which data require labels and special marking • Whether encryption is required for the data • Whether separation of duties is required • Lost opportunity costs that could be incurred if the data were not available or were corrupted Data are not the only things that must be classified. Applications and sometimes whole systems must be classified. The applications that hold and process classified information should be evaluated for the level of protection they provide. You do not want a program filled with security vulnerabilities to process and “protect” your most sensitive information. The application classifications should be based on the assurance (confidence level) the company has in the software and the type of information it can store and process. NOTE An organization must make sure that whoever is backing up classified data—and whoever has access to backed-up data—has the necessary clearance level. A large security risk can be introduced if low-end technicians with no security clearance have access to this information during their tasks. CAUTION The classification rules must apply to data no matter what format it is in: digital, paper, video, fax, audio, and so on. Now that we have chosen a sensitivity scheme, the next step is to specify how each classification should be dealt with. We must specify provisions for access control, identification, and labeling, along with how data in specific classifications are stored, maintained, transmitted, and destroyed. We also must iron out auditing, monitoring, and compliance issues. Each classification requires a different degree of security and, therefore, different requirements from each of the mentioned items.
Classification Controls As mentioned earlier, which types of controls are implemented per classification depends upon the level of protection that management and the security team have determined is needed. The numerous types of controls available are discussed throughout
ch03.indd 120
10/8/2007 1:51:08 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
121 Data Classification Procedures The following outlines the necessary steps for a proper classification program: 1. Define classification levels. 2. Specify the criteria that will determine how data are classified. 3. Have the data owner indicate the classification of the data she is responsible for. 4. Identify the data custodian who will be responsible for maintaining data and its security level. 5. Indicate the security controls, or protection mechanisms, required for each classification level. 6. Document any exceptions to the previous classification issues. 7. Indicate the methods that can be used to transfer custody of the information to a different data owner. 8. Create a procedure to periodically review the classification and ownership. Communicate any changes to the data custodian. 9. Indicate procedures for declassifying the data. 10. Integrate these issues into the security-awareness program so all employees understand how to handle data at different classification levels. It is important that once the organization has an understanding of the different levels of protection that must be provided, it can develop the necessary classification levels it will use. Keep some of these following ideas in mind as your organization develops its classification levels: • Too many classification levels will be impractical and add confusion. • Too few classification levels will give the perception of how little value is placed on the process and how little it will be used. • There should be no overlap in the criteria definitions between classification levels. • Classification levels should be developed for both data and software. this whole book. But some considerations pertaining to sensitive data and applications are common across most organizations: • Strict and granular access control for all levels of sensitive data and programs (see Chapter 4 for coverage of access controls, along with file system permissions that should be understood) • Encryption of data while stored and while in transmission (see Chapter 8 for coverage of all types of encryption technologies) • Auditing and monitoring (determine what level of auditing is required and how long logs are to be retained)
ch03.indd 121
10/8/2007 1:51:08 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
122 • Separation of duties (determine whether two or more people must be involved in accessing sensitive information to protect against fraudulent activities. If so, define and document procedures.) • Periodic reviews (review classification levels, and the data and programs that adhere to them, to ensure they are still in alignment with business needs; data or applications may also need to be reclassified or declassified, depending upon the situation) • Backup and recovery procedures (define and document) • Change control procedures (define and document) • Physical security protection (define and document) • Information flow channels • Data dictionary review • Proper disposal actions, such as shredding, degaussing, and so on (define and document) • File and file system access permissions (define and document) • Marking and labeling • The cover and inside documents should be labeled • All media should be marked and labeled (magnetic, optical media)
References • Guide for Mapping Types of Information and Information Systems to Security Categories http://csrc.nist.gov/publications/nistpubs/800-60/SP800-60V1final.pdf • Handbook of Information Security Management, Domain 4, Chapter 4-1-1, “Information Classification: A Corporate Implementation Guide,” Jim Appleyard (CRC Press LLC) www.cccure.org/Documents/HISM/303-308.html
Layers of Responsibility Senior management and other levels of management understand the vision of the company, the business goals, and the objectives. The next layer down is the functional management, whose members understand how their individual departments work, what roles individuals play within the company, and how security affects their department directly. The next layers are operational managers and staff. These layers are closer to the actual operations of the company. They know detailed information about the technical and procedural requirements, the systems, and how the systems are used. The employees at these layers understand how security mechanisms integrate into systems, how to configure them, and how they affect daily productivity. Every layer offers different insight into what type of role security plays within an organization, and each should have input into the best security practices, procedures, and chosen controls to ensure the agreed upon security level provides the necessary amount of protection without negatively affecting the company’s productivity.
ch03.indd 122
10/8/2007 1:51:08 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
123 Although each layer is important to the overall security of an organization, some specific roles must be clearly defined. Individuals who work in smaller environments (where everyone must wear several hats) may get overwhelmed with the number of roles presented next. Many commercial businesses do not have this level of structure in their security teams, but many government agencies and military units do. What you need to understand are the responsibilities that must be assigned, and whether they are assigned to just a few people or to a large security team. These roles are the data owner, data custodian, system owner, security administrator, security analyst, application owner, supervisor (user manager), change control analyst, data analyst, process owner, solution provider, user, product line manager, and the guy who gets everyone coffee.
Who’s Involved? I don’t want to be involved. I have heard that it is a lot of work. Response: Yes, indeed. It will require many in the organization to stretch their understanding and responsibilities. Many companies, and security professionals, are struggling with what security programs and governance really are and how responsibilities should be assigned throughout the organization. Identifying roles and responsibilities should happen very quickly when developing a security program, so we will discuss common roles and entities in corporations and their responsibilities as they pertain to asset protection.
The Board of Directors Hey, Enron was successful for many years. What’s wrong with their approach? The board of directors is a group of individuals who are elected by the shareholders of a corporation to oversee the fulfillment of the corporation’s charter. The goal of the board is to ensure the shareholders’ interests are being protected and that the corporation is being run properly. They are supposed to be unbiased and independent individuals who oversee the executive staff’s performance in running the company. For many years, too many people who held these positions either looked the other way regarding corporate fraud and mismanagement or depended too much on executive management’s feedback instead of finding out the truth about their company’s health themselves. We know this because of all of the corporate scandals uncovered in 2002 (Enron, WorldCom, Global Crossing, and so on). The boards of directors of these corporations were responsible for knowing about these types of fraudulent activities and putting a stop to them to protect shareholders. Many things caused the directors not to play the role they should have. Some were intentional, some not. These scandals forced the U.S. government and the Securities and Exchange Commission (SEC) to place more requirements, and potential penalties, on the boards of directors of publicly traded companies. This is why many companies today are having a harder time finding candidates to fulfill these roles—personal liability for a part-time job is a real downer. Independence is important if the board members are going to truly work for the benefit of the shareholders. This means the board members should not have immediate family that are employees of the company, the board members should not receive financial benefits from the company that could cloud their judgment or create conflicts of interests, and that no other activities should cause the board members to act other
ch03.indd 123
10/8/2007 1:51:09 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
124 than as champions of the company’s shareholders. This is especially true if the company must comply with the Sarbanes-Oxley Act. Under this Act, the board of directors can be held personally responsible if the corporation does not properly maintain an internal corporate governance framework, and/or if financials reported to the SEC are incorrect. NOTE Other regulations also call out requirements of boards of directors, as in the Gramm-Leach-Bliley Act (GLBA). But SOX is a regulation that holds the members of the board personally responsible, thus they can each be fined or go to jail. CAUTION The CISSP exam does not cover anything about specific regulations (SOX, HIPPA, GLBA, Basel II, SB 1386, and so on). So do not get wrapped up in studying these for the exam. However, it is critical that the security professional understand the regulations and laws of the country and region she is working within.
Principles of Federal Prosecution of Business Organizations The Department of Justice provides the following guidelines for attorneys when attempting to prosecute corporate wrongdoings: “Do the corporation’s directors exercise independent review over proposed corporate actions rather than unquestioningly ratifying officers’ recommendations; are the directors provided with information sufficient to enable the exercise of independent judgment; are internal audit functions conducted at a level sufficient to ensure their independence and accuracy; and have the directors established an information and reporting system in the organization reasonably designed to provide management and the board of directors with timely and accurate information sufficient to allow them to reach an informed decision regarding the organization’s compliance with the law.” More information can be found at www.usdoj.gov/dag/cftf/corporate_guidelines.htm.
Executive Management I am very important, but I am missing a “C.” Response: Then you are not so important. This motley crew is made up of individuals whose titles start with a “C.” The Chief Executive Officer (CEO) has the day-to-day management responsibilities of an organization. This person is often the chairman of the board of directors and is the highest ranking officer in the company. This role is for the person who oversees the company’s finances, strategic planning, and operations from a high level. The CEO is usually seen as the visionary for the company and is responsible for developing and modifying the company’s business plan. They set budgets, form partnerships, decide on what markets to enter, what product lines to develop, how the company will differentiate itself, and so on. This role’s overall responsibility is to ensure that the company grows and thrives.
ch03.indd 124
10/8/2007 1:51:09 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
125 NOTE The CEO can delegate tasks, but not necessarily responsibility. More and more regulations dealing with information security are holding this role’s feet to the fire, which is why security departments across the land are receiving more funding. Personal liability for the decision makers and pursestring holders has loosened up those purse strings, and companies are now able to spend more money on security than before. The Chief Financial Officer (CFO) is responsible for the corporation’s account and financial activities, and the overall financial structure of the organization. This person is responsible for determining what the company’s financial needs will be and how to finance those needs. The CFO must create and maintain the company’s capital structure, which is the proper mix of equity, credit, cash, and debt financing. This person oversees forecasting and budgeting and the processes of submitting quarterly and annual financial statements to the SEC and stakeholders. The CFO and CEO are responsible for informing stakeholders (creditors, analysts, employees, management, investors) of the firm’s financial condition and health. After the corporate debacles uncovered in 2002, the U.S. government and the SEC started doling out stiff penalties to people who held these roles and abused them, as shown in the following: • January 2004 – Ex-Enron chief financial officer Andrew Fastow was given a ten-year prison sentence for his accounting scandals, which was a reduced term because he cooperated with prosecutors. • June 2005 – John Rigas, the CEO of Adelphia Communications Corp., was sentenced to 15 years in prison for his role in the looting and debt-hiding scandal that pummeled the company into bankruptcy. His son, who also held an executive position, was sentenced to 20 years. • July 2005 – Ex-WorldCom chief executive officer Bernard Ebbers was sentenced to 25 years in prison for his role in orchestrating the biggest corporate fraud in the nation’s history. • August 2005 – Former WorldCom chief financial officer Scott Sullivan was sentenced to five years in prison for his role in engineering the $11 billion accounting fraud that led to the bankruptcy of the telecommunications powerhouse. • December 2005 – The former chief executive officer of HealthSouth Corp. was sentenced to five years in prison for his part in the $2.7 billion scandal. These are only the big ones that made it into all the headlines. Other CEOs and CFOs have also received punishments for “creative accounting” and fraudulent activities. Figure 3-12 shows us how the board members are responsible for setting the organization’s strategy and risk appetite (how much risk the company should take on). The board is also responsible for receiving information from executives, as well as the assurance (auditing committee). With these inputs, the board is supposed to ensure that the company is running properly, thus protecting shareholders’ interests. Also notice that the business unit owners are the risk owners, not the security department. Too many
ch03.indd 125
10/8/2007 1:51:09 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
126
Figure 3-12 Risk must be understood at different departments and levels.
companies are not extending the responsibility of risk out to the business units, which is why the CISO position is commonly referred to as the sacrificial lamb.
The Chief Information Officer On a lower rung of the food chain is the Chief Information Officer (CIO). This individual can report to the CEO or CFO, depending upon the corporate structure, and is responsible for the strategic use and management of information systems and technology within the organization. Over time, this position has become more strategic and less operational in many organizations. CIOs oversee and are responsible for the dayin-day-out technology operations of a company, but because organizations are so dependent upon technology, they are being asked to sit at the big boy’s corporate table more and more. CIO responsibilities have extended to working with the CEO (and other management) on business-process management, revenue generation, and how business strategy can be accomplished with the company’s underlying technology. This person usually should have one foot in techno-land and one foot in business-land to be effective, because he is bridging two very different worlds.
ch03.indd 126
10/8/2007 1:51:10 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
127 The CEO sets the stage for the protection of company assets and is ultimately responsible for the success of the company security program. Direction should be coming down from the CEO and there should be clear lines of communication between the board of directors, the C-level staff, and mid-management. In SOX, the CEO and CFO have outlined responsibilities and penalties they can be personally liable for if those responsibilities are not carried out. The SEC wanted to make sure these roles cannot just allow their companies to absorb fines if they misbehave. Under this law they can personally be fined millions of dollars and/or go to jail. Such things always make them perk up during meetings.
The Chief Privacy Officer The Chief Privacy Officer (CPO) is a newer position, created mainly because of the increasing demands on organizations to protect a long laundry list of different types of data. This role is responsible for ensuring that customer, company, and employee data are kept safe, which keeps the company out of criminal and civil courts and hopefully out of the headlines. This person is usually an attorney and is directly involved with setting policies on how data are collected, protected, and given out to third parties. The CPO often reports to the Chief Security Officer. It is important that the company understand the privacy, legal, and regulatory requirements the organization must comply with. With this knowledge, you can then develop the organization’s policies, standards, procedures, controls, and contract agreements to see if privacy requirements are being properly met. Remember also that organizations are responsible for knowing how their suppliers, partners, and other third parties are protecting this sensitive information. Many times, companies will need to review these other parties (which have copies of data needing protection). Some companies have carried out risk assessments without including the penalties and ramifications they would be forced to deal with if they did not properly protect the information they are responsible for. Without including these liabilities, risk cannot be properly assessed. The organization should document how privacy data are collected, used, disclosed, archived, and destroyed. Employees should be held accountable for not following the organization’s standards on how to handle this type of information. NOTE Carrying out a risk assessment from the perspective of the protection of sensitive data is called a Privacy Impact Analysis. You can review the following site to understand the steps: How to Do a Privacy Assessment— www.actcda.com/resource/multiapp.pdf. Since properly protecting sensitive data is so critical to organizations today, these requirements should be baked into many different business processes, such as purchasing and/or developing software that will house sensitive data, establishing IT communication mechanisms, and implementing and configuring security products. In each of these examples, the question of “What type of data will be stored or transmitted through this?” should be asked to ensure that the right level of protection is being provided.
ch03.indd 127
10/8/2007 1:51:10 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
128 International Requirements If the organization is exchanging data with European entities, it may need to adhere to the Safe Harbor requirements. Europe has always had tighter control over protecting privacy information than the U.S and other parts of the world. So in the past when U.S. and European companies needed to exchange data, there was confusion and interruption of business because the lawyers had to get involved to figure out how to work within the structures of the differing laws. To clear up this mess, a “safe harbor” framework was created, which outlines how any entity that is going to move privacy data to and from Europe must go about protecting it. U.S. companies that deal with European entities can become certified against this rule base so that data transfer can happen more quickly and easily. More information can be found at www.export.gov/safeharbor/sh_overview.html. Global organizations that move data across other country boundaries must also be aware of and follow the Organisation for Economic Co-operation and Development (OECD) Guidelines and transborder information flow rules. Almost every country has its own rules pertaining to what private data is and how it should be protected and dealt with. As the digital and information age came upon us, these different laws started to negatively affect business and international trade. The OECD is an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy. Thus, the OECD came up with guidelines for the various countries to follow so data are properly protected and everyone follows the same type of rules. More information can be found at www.oecd.org/document/18/ 0,2340,en_2649_34255_1815186_1_1_1_1,00.html. Organizations that do not follow these types of rules and guidelines (whether knowingly or otherwise) can be fined, sued, and their business disrupted. Some companies have had to actually move their WAN connections because they were transferring privacy data through a country and breaking its law without knowing it.
The Chief Security Officer Hey, we need a sacrificial lamb in case things go bad. Response: We already have one. He’s called the Chief Security Officer. The Chief Security Officer (CSO) is responsible for understanding the risks that the company faces and for mitigating these risks to an acceptable level. This role is responsible for understanding the organization’s business drivers and for creating and maintaining a security program that facilitates these drivers, along with providing security, compliancy with a long list of regulations and laws, and any customer expectations or contractual obligations. The creation of this role is a mark in the “win” column for the security industry because it means security is finally being seen as a business issue. Previously, security was stuck in the IT department and was viewed solely as a technology issue. As organizations saw the need to integrate security requirements and business needs, the need of creating a position for security in the executive management team became more of a
ch03.indd 128
10/8/2007 1:51:10 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
129 necessity. The CSO’s job is to ensure that business is not disrupted in any way due to security issues. This extends beyond IT and reaches into business processes, legal issues, operational issues, revenue generation, reputation protection, risk management—and all of this must be done in a cost-effective manner!
CSO vs. CISO The CSO and Chief Information Security Officer (CISO) may have similar or very different responsibilities. How is that for clarification? It is up to the individual organization to define the responsibilities of these two roles and whether they will use both, either, or neither. By and large, the CSO role usually has a farther reaching list of responsibilities compared to the CISO role. The CISO is usually focused more on technology and has an IT background. The CSO usually is required to understand a wider range of business risks, including physical security—not just technological risks. The CSO is usually more of a business person and typically is present in larger organizations. If a company has both roles, the CISO reports directly to the CSO.
The IS Security Steering Committee A security steering committee is responsible for making decisions on tactical and strategic security issues within the enterprise as a whole and should not be tied to one or more business units. The group should be made up of people from all over the organization so they can view risks and the effects of security decisions on individual departments and the organization as a whole. The CEO should head this committee, and the CFO, CIO, department managers, and chief internal auditor should all be on it. This committee should meet at least quarterly and have a well-defined agenda. Some of the group’s responsibilities are listed next: • Define the acceptable risk level for the organization. • Develop security objectives and strategies. • Determine priorities of security initiatives based on business needs. • Review risk assessment and auditing reports. • Monitor the business impact of security risks. • Review major security breaches and incidents. • Approve any major change to the security policy and program. They should also have a clearly defined vision statement in place that is set up to work with and support the organizational intent of the business. The statement should be structured in a manner that provides support for the goals of confidentiality, integrity, and availability as they pertain to the business objectives of the organization. This in turn should be followed, or supported, by a mission statement that provides support and definition to the processes that will apply to the organization and allow it to reach its business goals.
ch03.indd 129
10/8/2007 1:51:11 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
130 The Audit Committee The audit committee should be appointed by the board of directors to help it review and evaluate the company’s internal operations, internal audit system, and the transparency and accuracy of financial reporting so the company’s investors, customers, and creditors have continued confidence in the organization. This committee is usually responsible for at least the following items: • The integrity of the company’s financial statements and other financial information provided to stockholders and others • The company’s system of internal controls • The engagement and performance of the independent auditors • The performance of the internal audit function • Compliance with legal requirements and company policies regarding ethical conduct The goal of this committee is to provide independent and open communications among the board of directors, the company’s management, the internal auditors, and external auditors. Financial statement integrity and reliability is crucial to every organization, and many times pressure from shareholders, management, investors, and the public can directly affect the objectivity and correctness of these financial documents. In the wake of high-profile corporate scandals, the audit committee’s role has shifted from just overseeing, monitoring, and advising company management to enforcing and ensuring accountability on the part of all individuals involved. This committee must take input from external and internal auditors and outside experts to help ensure the company’s internal control processes and financial reporting are taking place properly.
The Data Owner The data owner (information owner) is usually a member of management who is in charge of a specific business unit, and who is ultimately responsible for the protection and use of a specific subset of information. The data owner has due care responsibilities and thus will be held responsible for any negligent act that results in the corruption or disclosure of the data. The data owner decides upon the classification of the data he is responsible for and alters that classification if the business need arises. This person is also responsible for ensuring that the necessary security controls are in place, defining security requirements per classification and backup requirements, approving any disclosure activities, ensuring that proper access rights are being used, and defining user access criteria. The data owner approves access requests or may choose to delegate this function to business unit managers. And it is the data owner who will deal with security violations pertaining to the data he is responsible for protecting. The data owner, who obviously has enough on his plate, delegates responsibility of the day-to-day maintenance of the data protection mechanisms to the data custodian.
ch03.indd 130
10/8/2007 1:51:11 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
131 The Data Custodian Hey, custodian, clean up my mess! Response: I’m not that type of custodian. The data custodian (information custodian) is responsible for maintaining and protecting the data. This role is usually filled by the IT or security department, and the duties include performing regular backups of the data, periodically validating the integrity of the data, restoring data from backup media, retaining records of activity, and fulfilling the requirements specified in the company’s security policy, standards, and guidelines that pertain to information security and data protection.
Data Owner Issues Each business unit should have a data owner who protects the unit’s most critical information. The company’s policies must give the data owners the necessary authority to carry out their tasks. This is not a technical role, but rather a business role that must understand the relationship between the unit’s success and the protection of this critical asset. Not all business people understand this role, so they should be given the necessary training.
The System Owner I am god over this system! Response: You are responsible for a printer? Your mother must be proud. The system owner is responsible for one or more systems, each of which may hold and process data owned by different data owners. A system owner is responsible for integrating security considerations into application and system purchasing decisions and development projects. The system owner is responsible for ensuring that adequate security is being provided by the necessary controls, password management, remote access controls, operating system configurations, and so on. This role must ensure the systems are properly assessed for vulnerabilities and must report any to the incident response team and data owner.
The Security Administrator Hey, I have administrator rights! Response: Great, you’re a security administrator. I quit. Anyone who has a root account on Unix or Linux systems or an administrator account on Windows or Macintosh systems actually has security administrator rights. (Unfortunately, too many people have these accounts in most environments.) This means they can give and take away permissions, set security configurations, and mess everything up if they are having a bad day. However, just because a person has a root or administrator account does not mean they are fulfilling the security administrator role. A security administrator’s tasks are
ch03.indd 131
10/8/2007 1:51:11 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
132 many, and include creating new system user accounts, implementing new security software, testing security patches and components, and issuing new passwords. (The security administrator should not actually approve new system user accounts. This is the responsibility of the supervisor.) The security administrator must make sure access rights given to users support the policies and data owner directives.
The Security Analyst I have analyzed your security and you have it all wrong. Response: What a surprise. The security analyst role works at a higher, more strategic level than the previously described roles and helps develop policies, standards, and guidelines, as well as set various baselines. Whereas the previous roles are “in the weeds” and focus on pieces and parts of the security program, a security analyst helps define the security program elements and follows through to ensure the elements are being carried out and practiced properly. This person works more at a design level than an implementation level.
The Application Owner Some applications are specific to individual business units—for example, the accounting department has accounting software, R&D has software for testing and development, and quality assurance uses some type of automated system. The application owners, usually the business unit managers, are responsible for dictating who can and cannot access their applications (subject to staying in compliance with the company’s security policies, of course). Since each unit claims ownership of its specific applications, the application owner for each unit is responsible for the security of the unit’s applications. This includes testing, patching, performing change control on the programs, and making sure the right controls are in place to provide the necessary level of protection.
The Supervisor The supervisor role, also called user manager, is ultimately responsible for all user activity and any assets created and owned by these users. For example, suppose Kathy is the supervisor of ten employees. Her responsibilities would include ensuring that these employees understand their responsibilities with respect to security, distributing initial passwords, making sure the employees’ account information is up-to-date, and informing the security administrator when an employee is fired, suspended, or transferred. Any change that pertains to an employee’s role within the company usually affects what access rights they should and should not have, so the user manager must inform the security administrator of these changes immediately.
The Change Control Analyst I am in charge of change control and I order you to change your socks! As someone wise once said, the only thing that is constant is change. So, when change does take place, someone must make sure it’s safe. The change control analyst
ch03.indd 132
10/8/2007 1:51:12 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
133 is responsible for approving or rejecting requests to make changes to the network, systems, or software. This role must make certain that the change will not introduce any vulnerabilities, that it has been properly tested, and that it is properly rolled out. The change control analyst needs to understand how various changes can affect security, interoperability, performance, and productivity. Or, a company can choose to just roll out the change and see what happens…
The Data Analyst Having proper data structures, definitions, and organization is very important to a company. The data analyst is responsible for ensuring that data is stored in a way that makes the most sense to the company and the individuals who need to access and work with it. For example, payroll information should not be mixed with inventory information, the purchasing department needs to have a lot of its values in monetary terms, and the inventory system must follow a standardized naming scheme. The data analyst may be responsible for architecting a new system that will hold company information or advise in the purchase of a product that will do so. The data analyst works with the data owners to help ensure that the structures set up coincide with and support the company’s business objectives.
The Process Owner Ever heard the popular mantra, “Security is not a product, it’s a process”? The statement is very true. Security should be considered and treated like any another business process—not as its own island, nor like a redheaded step-child with cooties. (The author is a redheaded step-child, but currently has no cooties.) All organizations have many processes: how to take orders from customers; how to make widgets to fulfill these orders; how to ship the widgets to the customers; and how to collect from customers when they don’t pay their bills; and so on. An organization could not function properly without well-defined processes. The process owner is responsible for properly defining, improving upon, and monitoring these processes. A process owner is not necessarily tied to one business unit or application. Complex processes involve many variables that can span different departments, technologies, and data types.
The Solution Provider I came up with the solution to world peace, but then I forgot it. Response: Write it down on this napkin next time. Every vendor you talk to will tell you they are the right solution provider for whatever ails you. In truth, several different types of solution providers exist, because the world is full of different problems. This role is called upon when a business has a problem or requires a process be improved upon. For example, if Company A needs a solution that supports digitally signed e-mails and an authentication framework for employees, it would turn to a public key infrastructure (PKI) solution provider. A solution provider works with the business unit managers, data owners, and senior management to develop and deploy a solution to reduce the company’s pain points.
ch03.indd 133
10/8/2007 1:51:12 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
134 The User The user is any individual who routinely uses the data for work-related tasks. The user must have the necessary level of access to the data to perform the duties within their position and is responsible for following operational security procedures to ensure the data’s confidentiality, integrity, and availability to others.
The Product Line Manager Who’s the guy responsible for explaining business requirements to vendors and wading through their rhetoric to see if the product is right for the company? Who is the guy responsible for ensuring compliance to license agreements? Who is the guy translating business requirements into objectives and specifications for the developer of a product or solution? Who is the guy who decides if his company really needs to upgrade their operating system version every time Microsoft wants to make more money? That would be the product line manager. This role must understand business drivers, business processes, and the technology that is required to support them. The product line manager evaluates different products in the market, works with vendors, understands different options a company can take, and advises management and business units on the proper solutions needed to meet their goals.
The Auditor The function of the auditor is to provide a method for ensuring independently that management and shareholders of an organization can rely upon the appropriateness of security objectives as well as the information they are being provided with regarding the status of the organization as a whole. The auditor is brought in to an organization to determine if the controls that have been implemented by the administration for either technical or physical attributes have reached, and comply with, the security objectives that are either required for the organization by legislation or have been deemed necessary by the governance of the organization. Auditors can conduct either internal or external auditing of an organization and a combination of both will usually provide the most comprehensive and objective evaluation of the organization being evaluated. The biggest concern for auditors is the question of bias and objectivity. The use of a third party for reviews will typically alleviate that issue, and in some instances there are actually legal mandates and regulations that prevent even third-party auditors from working for too many years in a row with a single organization in order to prevent them from becoming too close and thereby compromising their objectivity in evaluations and audits.
Why So Many Roles? A decision maker is not the proper role for the data custodian or system administrator in protecting system resources. They may have the technical knowledge of how security mechanisms should be implemented and configured, but they should not be put into a position of deciding how the company approaches security and what security measures should be implemented. Too many times companies handle security at the administrator level. In these situations, security is not viewed in broad enough terms.
ch03.indd 134
10/8/2007 1:51:12 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
135 Proper risk analysis is usually not performed. Senior management is not fully aware of the risks the company faces. Not enough funds are available for security, and when a security breach takes place, there is no efficient way of dealing with it. As stated previously, security should work in a top-down fashion to be ultimately successful. A company’s security is not tied only to the type of firewall installed and the timeliness of security patches being applied. A company is an environment filled with various resources, activities, people, and practices. The security of the environment must be approached in a holistic way, with each part of security addressed in a serious and responsible manner. Although most environments will not contain all of the roles outlined previously, all of these responsibilities still must be carried out.
References • Security School for CISSP Training: Domain Spotlight on Security Management Practices http://searchsecurity.techtarget.com/content/ 0,290959,sid14_gci1010840,00.html • NIST Administrative Manual, Subchapter 11.02, “Information Technology Security” www.nist.gov/admin/mo/adman/1102.HTM • Information Security Management Handbook, Domain 3, Chapter 3-5-3, “Information Protection: Organization, Roles, and Separation of Duties,” Rebecca Herold (CRC Press LLC, 2003) www.delcreo.com/delcreo/free/ docs/Information%20Protection.pdf
Personnel Many facets of the responsibilities of personnel fall under management’s umbrella, and several facets have a direct correlation to the overall security of the environment. Although society has evolved to be extremely dependent upon technology in the workplace, people are still the key ingredient to a successful company. But in security circles, people are often the weakest link. Either accidentally through mistakes or lack of training or intentionally through fraud and malicious intent, personnel cause more serious and hard-to-detect security issues than hacker attacks, outside espionage, or equipment failure. Although the future actions of individuals cannot be predicted, it is possible to minimize the risks by implementing preventive measures. These include hiring the most qualified individuals, performing background checks, using detailed job descriptions, providing necessary training, enforcing strict access controls, and terminating individuals in a way that protects all parties involved.
Structure If a company wants to have effective employee safety, management must put in place a certain structure and actually follow it. This structure includes clear definitions of responsibilities, lines of authority, and acceptable reprimands for specific activities. A clear-cut structure takes the mystery out of who does what, and how things are handled in different situations. Several items can be put into place to reduce the possibilities of fraud, sabotage, misuse of information, theft, and other security compromises. Separation of duties
ch03.indd 135
10/8/2007 1:51:12 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
136 makes sure that one individual cannot complete a critical task by herself. In the movies, when a submarine captain needs to launch a nuclear torpedo to blow up the enemy and save civilization as we know it, the launch usually requires three codes to be entered into the launching mechanism by three different senior crewmembers. This is an example of separation of duties, and it ensures that the captain cannot complete such an important and terrifying task all by herself. NOTE Separation of duties may also reduce errors. If one person makes a mistake, there is a high probability that another person will catch and correct it. In an organization that practices separation of duties, collusion must take place for fraud to be committed. Collusion means that at least two people are working together to cause some type of destruction or fraud. In a software development environment, there should be clear distinctions between programmers, testing environments, libraries, operations, and production. Programmers should be able to work on their code and test it as needed. Once the programmer is finished with her tasks, she turns the code over to quality assurance, who in turn run their own tests in another environment that mirrors the production environment. Once the code passes all the necessary tests, it should be stored in a software library. When it is necessary for the code to go into production, it moves from the library to the production environment. Code should not go from the programmer directly to production without testing and checking it into the library. The test environment should be clearly differentiated from the production environment to ensure that untested code does not accidentally go into production. And the programmer should not tinker with the software once it is in production. These clear-cut methods make sure no steps are skipped in the phases of software development, and that changes are not made in unstructured and dangerous ways.
Hiring Practices I like your hat. You’re hired! Depending on the position to be filled, a level of screening should be done by human resources to ensure the company hires the right individual for the right job. Skills should be tested and evaluated, and the caliber and character of the individual should be examined. Joe might be the best programmer in the state, but if someone looks into his past and finds out he served prison time because he continually flashes old ladies in parks, the hiring manager might not be so eager to bring Joe into the organization. Nondisclosure agreements must be developed and signed by new employees to protect the company and its sensitive information. Any conflicts of interest must be addressed, and there should be different agreements and precautions taken with temporary and contract employees. References should be checked, military records reviewed, education verified, and if necessary, a drug test should be administered. Many times, important personal behaviors can be concealed, and that is why hiring practices now include scenario questions, personality tests, and observations of the individual, instead of just looking at a person’s work history. When a person is hired, he is bringing in his business skills and
ch03.indd 136
10/8/2007 1:51:13 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
137 whatever other baggage he carries. A company can reduce its heartache pertaining to personnel by first conducting useful and carefully carried out hiring practices. Also, when references are being checked, it may be a good idea to have a background check performed on the potential new employee. These can cover things not readily apparent or obvious during the course of a simple reference check. Many organizations do not feel they have the time or resources to conduct background checks on their potential employees because they need to fill positions as quickly as possible. This can lead to hiring a person for “right now” instead of the “right person.” Employees represent an investment on the part of the organization and by taking the time and hiring the right people for the jobs, the organization will be able to maximize their investment and achieve a better return. A more detailed background check can reveal some interesting information. Things like unexplained gaps in employment history, the validity and actual status of professional certifications, criminal records, driving records, job titles that have been misrepresented, credit histories, unfriendly terminations, appearances on suspected terrorist watch lists, and even real reasons for having left previous jobs can all be determined through the use of background checks. This has real benefit to the employer and the organization because it serves as the first line of defense for the organization against being attacked from within. Any negative information that can be found in these areas could be indicators of potential problems that the potential employee could create for the company at a later date. Take the credit report for instance. On the surface, this may seem to be something the organization doesn’t need to know about, but if the report indicates the potential employee has a poor credit standing and a history of financial problems, it could mean you don’t want to place them in charge of the organization’s accounting, or even the petty cash. Ultimately, the goal here is to achieve several different things at the same time by using a background check. You’re trying to mitigate risk, lower hiring costs, and also lower the turnover rate for employees. All this is being done at the same time you are trying to protect your existing customers and employees from someone gaining employment in your organization that could potentially conduct malicious and dishonest actions that could harm you, your employees, and your customers as well as the general public. In many cases, it is also harder to go back and conduct background checks after the individual has been hired and is working. This is because there will need to be a specific cause or reason for conducting this kind of investigation, and if any employee moves to a position of greater security sensitivity or potential risk, a follow-up investigation should be considered. Possible background check criteria could include: • A Social Security Number Trace • A County/State Criminal Check • A Federal Criminal Check • A Sexual Offender Registry Check • Employment Verification • Education Verification • Professional Reference Verification • An Immigration Check
ch03.indd 137
10/8/2007 1:51:13 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
138 Additional verification checks for higher-level or sensitive positions could include: • Office of Foreign Asset Control (OFAC) – USA PATRIOT Act • Professional License/Certification Verification • Credit Report • Drug Screening NOTE If a low-level background check was carried out for an employee that is now moving into a more sensitive position, a more in-depth background check may be required.
Employee Controls A management structure must be in place to make sure everyone has someone to report to and that the responsibility for another person’s actions is spread equally and intelligently. Consequences for noncompliance or unacceptable behavior must be communicated before an event takes place. Proper supervisory skills must be acquired and used to ensure that operations go smoothly and that any out-of-the-ordinary activities can be taken care of before they get out of control. Rotation of duties (rotation of assignments) is an important control to keep each department a healthy and productive part of the company. No one person should stay in one position for a long period of time because they may end up having too much control over a segment of the business. Such total control could result in fraud, data modification, and misuse of resources. Employees in sensitive areas should be forced to take their vacations, which is known as a mandatory vacation policy. While they are on vacation, other individuals fill their positions and thus can usually detect any fraudulent errors or activities. Two of the many ways to detect fraud or inappropriate activities would be the discovery of activity on someone’s user account while they’re supposed to be away on vacation, or if a specific problem stopped while someone was away and not active on the network. These anomalies are worthy of investigation. Two variations of separation of duties and control are split knowledge and dual control. In both cases, two or more individuals are authorized and required to perform a duty or task. In the case of split knowledge, no one person knows or has all the details to perform a task. For example, two managers might be required to open a bank vault, with each only knowing part of the combination. In the case of dual control, two individuals are again authorized to perform a task, but both must be available and active in their participation to complete the task or mission. For example, two officers must perform an identical key-turn in a nuclear missile submarine, each out of reach of the other, to launch a missile. The control here is that no one person has the capability of launching a missile, because they cannot reach to turn both keys at the same time.
Termination Because terminations can happen for a variety of different reasons and terminated people will have different reactions, companies should have a specific set of procedures to follow with each and every termination. For example:
ch03.indd 138
10/8/2007 1:51:13 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
139 • The employee must leave the facility immediately under the supervision of a manager or security guard. • The employee must surrender any identification badges or keys, complete an exit interview, and return company supplies. • That user’s accounts and passwords should be disabled or changed immediately. It seems harsh and cold when this actually takes place, but too many companies have been hurt by vengeful employees who have lashed out at the company when their positions were revoked for one reason or another. If an employee is disgruntled in any way, or the termination is unfriendly, that employee’s accounts should be disabled right away and all passwords on all systems changed.
Security-Awareness Training The management’s directives pertaining to security are captured in the security policy, and the standards, procedures, and guidelines are developed to support these directives. However, these directives will not be effective if no one knows about them and how the company expects them to be implemented. For security to be successful and effective, senior management on down to the rest of the staff must be fully aware of the importance of enterprise and information security. All employees should understand the underlying significance of security and the specific security-related requirements expected of them. The controls and procedures of a security program should reflect the nature of the data being processed. A company that sells baseball cards would not need the level of structured controls and security procedures required of a company that develops heatseeking missiles. These different types of companies would also have very different cultures. For a security-awareness program to be effective, these considerations must be understood. The program should be developed in a way that makes sense for that environment. For an organization to achieve the desired results of its security program, it must communicate the what, how, and why of security to its employees. Security-awareness training should be comprehensive, tailored for specific groups, and organization-wide. The goal is that each employee understands the importance of security to the company as a whole and to each individual. Expected responsibilities and acceptable behaviors must be clarified, and noncompliance repercussions, which could range from a warning to dismissal, must be explained before being invoked. This can best be achieved though a formalized process of security-awareness training. Because security is a topic that can span many different aspects of an organization, it can be difficult to communicate the correct information to the right individuals. By using a formalized process for security-awareness training, you can establish a method that will provide you with the best results for making sure security policies and procedures are presented to the right people in an organization. This way you can make sure everyone understands what a corporate security policy is, why having the security policy is important, and how it fits into the individual’s role in the organization. Taking this approach will also allow you to address any individuals that may feel they do not have any
ch03.indd 139
10/8/2007 1:51:14 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
140 security responsibilities in their current work role. It is also an ideal time to impress upon them the need to comply with the security policies as well as lay out what the penalties for noncompliance will be. Issues such as how the new policies and procedures will affect the organization and what types of things employees should be looking for can also be properly explained. Like other training or planning, the higher levels may be more general and deal with broader concepts and goals, and as it moves down to specific jobs and tasks, the training will become more situation-specific as it directly applies to certain positions within the company.
Different Types of Security-Awareness Training I want my training to have a lot of pictures and pop-up books. A security-awareness program is typically created for at least three types of audiences: management, staff, and technical employees. Each type of awareness training must be geared toward the individual audience to ensure each group understands its particular responsibilities, liabilities, and expectations. If technical security training were given to senior management, their eyes would glaze over as soon as protocols and firewalls were mentioned. On the flip side, if legal ramifications, company liability issues pertaining to protecting data, and shareholders’ expectations were discussed with the IT group, they would quickly start a game of hangman or tic-tac-toe with their neighbor. Members of management would benefit the most from a short, focused securityawareness orientation that discusses corporate assets and financial gains and losses pertaining to security. They need to know how stock prices can be negatively affected by compromises, understand possible threats and their outcomes, and know why security must be integrated into the environment the same way as other business processes. Because members of management must lead the rest of the company in support of security, they must gain the right mind-set about its importance. Mid-management would benefit from a more detailed explanation of the policies, procedures, standards, and guidelines and how they map to the individual departments for which they are responsible. Middle managers should be taught why their support for their specific departments is critical and what their level of responsibility is for ensuring that employees practice safe computing activities. They should also be shown how the consequences of noncompliance by individuals who report to them can affect the company as a whole and how they, as managers, may have to answer for such indiscretions. The technical departments must receive a different presentation that aligns more to their daily tasks. They should receive a more in-depth training to discuss technical configurations, incident handling, and indications of different types of security compromises so they can be properly recognized. Each group needs to know to whom it should report suspicious activity and how to handle these situations. Employees should not try to combat an attacker or address fraudulent activities by themselves. Each employee should be told to report these issues to upper management, and then upper management should determine how to handle the situation. The presentation given to staff members must demonstrate why security is important to the company and to them individually. The better they understand how insecure
ch03.indd 140
10/8/2007 1:51:14 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
141 activities can negatively affect them, the more willing they will be to participate in preventing such activities. This presentation should have many examples of acceptable and unacceptable activities. Examples of these activities can include questioning an unknown individual in a restricted portion of the facility, appropriate usage of Internet and e-mail, not removing company-owned material, and intellectual property issues. It is usually best to have each employee sign a document indicating they have heard and understand all the security topics discussed, and that they also understand the ramifications of noncompliance. This reinforces the policies’ importance to the employee and also provides evidence down the road if the employee claims they were never told of these expectations. Security training should happen periodically and continually. We learn mostly by repetition, and this training should take place at least once a year. The goal is to get individuals to understand not only how security works in their environment, but also why it is important. The main reason to perform security-awareness training is to modify employees’ behavior and attitude toward security. Various types of methods should be employed to reinforce the concepts of security awareness. Things like banners, employee handbooks, and even posters can be used as ways to remind employees about their duties and the necessities of good security practices. Refresher courses should be performed annually to reemphasize the importance of the security policies and practices of their organization. This also provides an ideal situation to remind people about the policies, standards, baselines, and guidelines they should be adhering to, as well as practices for incident reporting, and how they can be affected by malware, social engineering, and other hazards.
Evaluating the Program Security-awareness training is a type of control, and just like any other control it should be monitored and evaluated for its effectiveness. There is no reason to spend money on something that is not working, and there is no reason not to improve something if it needs improvement. Therefore, after employees attend awareness training, a company may give them questionnaires and surveys to gauge their retention level and to get their feedback about the training, to evaluate the program’s effectiveness. Unfortunately, some people will be resistant and negative because they feel as though they are being forced to do something they do not want to do, or are being talked down to. Just expect this attitude here and there and use your wonderful wit, charm, and communication skills with them. A good indication of the effectiveness of the program can be captured by comparing the number of reports of security incidents made before and after the training. If the reports increased after the training, this means people were listening and followed through on the information provided to them. NOTE For online training, capture individuals’ names and what training modules have or have not been completed within a specific time period. This can then be integrated into their job performance documentation.
ch03.indd 141
10/8/2007 1:51:14 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
142 Security-awareness training must repeat the most important messages in different formats, be kept up-to-date, be entertaining, positive, and humorous, be simple to understand, and—most important—be supported by senior management. Management must allocate the resources for this activity and enforce its attendance within the organization.
Specialized Security Training Companies today spend a lot of money on security devices and technologies, but they commonly overlook the fact that individuals must be trained to use these devices and technologies. Without such training, the money invested toward reducing threats is wasted and the company is still insecure. Many individuals seem to agree that people are the weakest link in security, but not enough effort goes into educating these people. Different roles require different types of training (firewall administration, risk management, policy development, IDSs, and so on). A skilled staff is one of the most critical components to the security of a company, and not enough companies are spending the funds and energy necessary to give their staffs proper levels of security education.
Degree or Certification Awareness training and materials remind employees of their responsibilities pertaining to protecting company assets. Training provides skills needed to carry out specific tasks and functions. Education provides management skills and decisionmaking capabilities. Table 3-9 provides more information on the difference between awareness, training, and education.
Awareness
Training
Education
Attribute
“What”
“How”
“Why”
Level
Information
Knowledge
Insight
Learning Objective
Recognition and retention
Skill
Understanding
Example Teaching Method
Media
Practical Instruction
• Videos • Newsletters • Posters
• Lecture and/or
Theoretical Instruction
True/False Multiple Choice
Problem Solving— i.e., Recognition and Resolution
Test Measure
demo
• Case study • Hands-on practice
• Seminar and discussion
• Reading and study • Research Essay (Interpret learning)
(Identify learning) (Apply learning) Impact Timeframe
Short-term
Intermediate
Long-term
Table 3-9 Aspects of Awareness, Training, and Education
ch03.indd 142
10/8/2007 1:51:14 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
143 References • Free practice quizzes www.LogicalSecurity.org • CISSP and SSCP Open Study Guides www.cccure.org • Information Technology Security Training Requirements: A Role- and PerformanceBased Model, Dorothea de Zafra et al., NIST Special Publication 800-16 (April 1998) http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf • CSRC Awareness, Training, and Education links http://csrc.nist.gov/ATE/
Summary A security program should address issues from a strategic, tactical, and operational view, as shown in Figure 3-13. Security management embodies the administrative and procedural activities necessary to support and protect information and company assets
Figure 3-13 A complete security program contains many items.
ch03.indd 143
10/8/2007 1:51:15 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
144 throughout the enterprise. It includes development and enforcement of security policies and their supporting mechanisms: procedures, standards, baselines, and guidelines. It encompasses risk management, security-awareness training, and proper countermeasure selection and implementation. Personnel (hiring, terminating, training, and management structure) and operational (job rotation and separation of duties) activities must also be conducted properly to ensure a secure environment. Management must understand the legal and ethical responsibilities it is required to respect and uphold. Security is a business issue and should be treated as such. It must be properly integrated into the company’s overall business goals and objectives because security issues can negatively affect the resources the company depends upon. More and more corporations are finding out the price paid when security is not given the proper attention, support, and funds. This is a wonderful world to live in, but bad things can happen. The ones who realize this notion not only survive, but thrive.
Quick Tips • A vulnerability is the absence of a safeguard (in other words, it is a weakness) that can be exploited. • A threat is the possibility that someone or something would exploit a vulnerability, intentionally or accidentally, and cause harm to an asset. • A risk is the probability of a threat agent exploiting a vulnerability and the loss potential from that action. • Reducing vulnerabilities and/or threats reduces risk. • An exposure is an instance of being exposed to losses from a threat. • A countermeasure, also called a safeguard, mitigates the risk. • A countermeasure can be an application, software configuration, hardware, or procedure. • If someone is practicing due care, they are acting responsibly and will have a lower probability of being found negligent and liable if a security breach takes place. • Security management has become more important over the years because networks have evolved from centralized environments to distributed environments. • The objectives of security are to provide availability, integrity, and confidentiality protection to data and resources. • Strategic planning is long term, tactical planning is midterm, and operational planning is day to day. These make up a planning horizon. • ISO 17799 is a comprehensive set of controls comprising best practices in information security and provides guidelines on how to set up and maintain security programs. • Security components can be technical (firewalls, encryption, and access control lists) or nontechnical (security policy, procedures, and compliance enforcement).
ch03.indd 144
10/8/2007 1:51:15 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
145 • Asset identification should include tangible assets (facilities, hardware) and intangible assets (corporate data, reputation). • Project sizing, which means to understand and document the scope of the project, must be done before a risk analysis is performed. • Assurance is a degree of confidence that a certain security level is being provided. • CobiT is a framework that defines goals for the controls that should be used to properly manage IT and ensure IT maps to business needs. • CobiT is broken down into four domains; Plan and Organize, Acquire and Implement, Deliver and Support, and Monitor and Evaluate. • ISO 17799:2005 is the newest version of BS7799 Part 1. • ISO 27001:2005 is the newest version of BS7700 Part II. • ISO 27001:2005 provides the steps for setting up and maintaining a security program. • ISO 17799:2005 provides a list of controls that can be used within the framework outlined in ISO 27001:2005. • Security management should work from the top down, from senior management down to the staff. • Governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly. • Which security model a company should choose depends on the type of business, its critical missions, and its objectives. • The OECD is an international organization that helps different governments come together and tackle the economic, social, and governance challenges of a globalized economy. • Risk can be transferred, avoided, reduced, or accepted. • An example of risk transference is when a company buys insurance. • Ways to reduce risk include improving security procedures and implementing safeguards. • Threats × vulnerability × asset value = total risk • (Threats × vulnerability × asset value) × controls gap = residual risk • The main goals of risk analysis are the following: identify assets and assign values to them, identify vulnerabilities and threats, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the safeguards. • Information risk management (IRM) is the process of identifying, assessing, and reducing risk to an acceptable level and implementing the right mechanisms to maintain that level of risk.
ch03.indd 145
10/8/2007 1:51:15 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
146 • Failure Modes and Effect Analysis (FMEA) is a method for determining functions, identifying functional failures, and assessing the causes of failure and their failure effects through a structured process. • A fault tree analysis is a useful approach to detect failures that can take place within complex environments and systems. • A quantitative risk analysis attempts to assign monetary values to components within the analysis. • A purely quantitative risk analysis is not possible because qualitative items cannot be quantified with precision. • Capturing the degree of uncertainty when carrying out a risk analysis is important, because it indicates the level of confidence the team and management should have in the resulting figures. • When determining the value of information, the following issues must be considered: the cost to acquire and develop data; the cost to maintain and protect data; the value of the data to owners, users, and adversaries; the cost of replacement if the data is lost; the price others are willing to pay for the data; lost opportunities; and the usefulness of the data, • Automated risk analysis tools reduce the amount of manual work involved in the analysis. They can be used to estimate future expected losses and calculate the benefits of different security measures. • Single loss expectancy (SLE) is the amount that could be lost if a specific threat agent exploited a vulnerability. • Single loss expectancy × frequency per year = annualized loss expectancy (SLE × ARO = ALE) • Qualitative risk analysis uses judgment and intuition instead of numbers. • Qualitative risk analysis involves people with the requisite experience and education evaluating threat scenarios and rating the probability, potential loss, and severity of each threat based on their personal experience. • The Delphi technique is a group decision method where each group member can communicate anonymously. • When choosing the right safeguard to reduce a specific risk, the cost, functionality, and effectiveness must be evaluated and a cost/benefit analysis performed. • A security policy is a statement by management dictating the role security plays in the organization. • Procedures are detailed step-by-step actions that should be followed to achieve a certain task. • A standard specifies how hardware and software are to be used. Standards are compulsory. • A baseline is a minimum level of security.
ch03.indd 146
10/8/2007 1:51:16 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
147 • Guidelines are recommendations and general approaches that provide advice and flexibility. • Job rotation is a control to detect fraud. • Mandatory vacations are a control type that can help detect fraudulent activities. • Separation of duties ensures no single person has total control over an activity or task. • Split knowledge and dual control are two aspects of separation of duties. • Data is classified to assign priorities to data and ensure the appropriate level of protection is provided. • Data owners specify the classification of data. • Security has functional requirements, which define the expected behavior from a product or system, and assurance requirements, which establish confidence in the implemented products or systems overall. • The security program should be integrated with current business objectives and goals. • Management must define the scope and purpose of security management, provide support, appoint a security team, delegate responsibility, and review the team’s findings. • The risk management team should include individuals from different departments within the organization, not just technical personnel. • A qualitative rating would be expressed in high, medium, or low, or on a scale of 1 to 5 or 1 to 10. A quantitative result would be expressed in dollar amounts and percentages. • Safeguards should default to least privilege, and have fail-safe defaults and override capabilities. • Safeguards should be imposed uniformly so everyone has the same restrictions and functionality. • A key element during the initial security planning process is to define reporting relationships. • The data custodian (information custodian) is responsible for maintaining and protecting data. • A security analyst works at a strategic level and helps develop policies, standards, and guidelines, and also sets various baselines. • Application owners are responsible for dictating who can and cannot access their applications, as well as the level of protection these applications provide for the data they process and for the company.
Questions Please remember that these questions are formatted and asked in a certain way for a reason. You must remember that the CISSP exam is asking questions at a conceptual level. Questions may not always have the perfect answer, and the candidate is advised
ch03.indd 147
10/8/2007 1:51:16 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
148 against always looking for the perfect answer. The candidate should look for the best answer in the list. 1. Who has the primary responsibility of determining the classification level for information? A. The functional manager B. Senior management C. The owner D. The user 2. Which group causes the most risk of fraud and computer compromises? A. Employees B. Hackers C. Attackers D. Contractors 3. If different user groups with different security access levels need to access the same information, which of the following actions should management take? A. Decrease the security level on the information to ensure accessibility and usability of the information. B. Require specific written approval each time an individual needs to access the information. C. Increase the security controls on the information. D. Decrease the classification label on the information. 4. What should management consider the most when classifying data? A. The type of employees, contractors, and customers who will be accessing the data. B. Availability, integrity, and confidentiality. C. Assessing the risk level and disabling countermeasures. D. The access controls that will be protecting the data. 5. Who is ultimately responsible for making sure data is classified and protected? A. Data owners B. Users C. Administrators D. Management 6. What is a procedure? A. Rules on how software and hardware must be used within the environment B. Step-by-step directions on how to accomplish a task
ch03.indd 148
10/8/2007 1:51:16 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
149 C. Guidelines on how to approach security situations not covered by standards D. Compulsory actions 7. Which factor is the most important item when it comes to ensuring security is successful in an organization? A. Senior management support B. Effective controls and implementation methods C. Updated and relevant security policies and procedures D. Security awareness by all employees 8. When is it acceptable to not take action on an identified risk? A. Never. Good security addresses and reduces all risks. B. When political issues prevent this type of risk from being addressed. C. When the necessary countermeasure is complex. D. When the cost of the countermeasure outweighs the value of the asset and potential loss. 9. What are security policies? A. Step-by-step directions on how to accomplish security tasks B. General guidelines used to accomplish a specific security level C. Broad, high-level statements from the management D. Detailed documents explaining how security incidents should be handled 10. Which is the most valuable technique when determining if a specific security control should be implemented? A. Risk analysis B. Cost/benefit analysis C. ALE results D. Identifying the vulnerabilities and threats causing the risk 11. Which best describes the purpose of the ALE calculation? A. Quantifies the security level of the environment B. Estimates the loss possible for a countermeasure C. Quantifies the cost/benefit result D. Estimates the loss potential of a threat in a span of a year 12. Tactical planning is: A. Midterm B. Long term C. Day-to-day D. Six months
ch03.indd 149
10/8/2007 1:51:16 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
150 13. What is the definition of a security exposure? A. An instance of being exposed to losses from a threat B. Any potential danger to information or systems C. An information security absence or weakness D. A loss potential of a threat 14. An effective security program requires a balanced application of: A. Technical and nontechnical methods B. Countermeasures and safeguards C. Physical security and technical controls D. Procedural security and encryption 15. The security functionality defines the expected activities of a security mechanism, and assurance defines: A. The controls the security mechanism will enforce B. The data classification after the security mechanism has been implemented C. The confidence of the security the mechanism is providing D. The cost/benefit relationship 16. Which statement is true when looking at security objectives in the privatebusiness sector versus the military sector? A. Only the military has true security. B. Businesses usually care more about data integrity and availability, whereas the military is more concerned with confidentiality. C. The military requires higher levels of security because the risks are so much higher. D. The business sector usually cares most about data availability and confidentiality, whereas the military is most concerned with integrity. 17. How do you calculate residual risk? A. Threats × risks × asset value B. (Threats × asset value × vulnerability) × risks C. SLE × frequency = ALE D. (Threats × vulnerability × asset value) × controls gap 18. Which of the following is not a purpose of doing a risk analysis? A. Delegating responsibility B. Quantifying the impact of potential threats C. Identifying risks D. Defining the balance between the impact of a risk and the cost of the necessary countermeasure
ch03.indd 150
10/8/2007 1:51:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
151 19. Which of the following is not a management role in the process of implementing and maintaining security? A. Support B. Performing risk analysis C. Defining purpose and scope D. Delegating responsibility 20. Why should the team that will perform and review the risk analysis information be made up of people in different departments? A. To make sure the process is fair and that no one is left out. B. It shouldn’t. It should be a small group brought in from outside the organization because otherwise the analysis is biased and unusable. C. Because people in different departments understand the risks of their department. Thus, it ensures the data going into the analysis is as close to reality as possible. D. Because the people in the different departments are the ones causing the risks, so they should be the ones held accountable. 21. Which best describes a quantitative risk analysis? A. A scenario-based analysis to research different security threats B. A method used to apply severity levels to potential loss, probability of loss, and risks C. A method that assigns monetary values to components in the risk assessment D. A method that is based on gut feelings and opinions 22. Why is a truly quantitative risk analysis not possible to achieve? A. It is possible, which is why it is used. B. It assigns severity levels. Thus, it is hard to translate into monetary values. C. It is dealing with purely quantitative elements. D. Quantitative measures must be applied to qualitative elements. 23. If there are automated tools for risk analysis, why does it take so much time to complete? A. A lot of data must be gathered and input into the automated tool. B. Management must approve it and then a team must be built. C. Risk analysis cannot be automated because of the nature of the assessment. D. Many people must agree on the same data.
ch03.indd 151
10/8/2007 1:51:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
152 24. Which of the following is a legal term that pertains to a company or individual taking reasonable actions and is used to determine liability? A. Standards B. Due process C. Due care D. Downstream liabilities
Answers 1. C. A company can have one specific data owner or different data owners who have been delegated the responsibility of protecting specific sets of data. One of the responsibilities that goes into protecting this information is properly classifying it. 2. A. It is commonly stated that internal threats comprise 70–80 percent of the overall threat to a company. This is because employees already have privileged access to a wide range of company assets. The outsider who wants to cause damage must obtain this level of access before she can carry out the type of damage internal personnel could dish out. A lot of the damages caused by internal employees are brought about by mistakes and system misconfigurations. 3. C. If data is going to be available to a wide range of people, more granular security should be implemented to ensure that only the necessary people access the data and that the operations they carry out are controlled. The security implemented can come in the form of authentication and authorization technologies, encryption, and specific access control mechanisms. 4. B. The best answer to this question is B, because to properly classify data, the data owner must evaluate the availability, integrity, and confidentiality requirements of the data. Once this evaluation is done, it will dictate which employees, contractors, and users can access the data, which is expressed in answer A. This assessment will also help determine the controls that should be put into place. 5. D. The key to this question is the use of the word “ultimately.” Though management can delegate tasks to others, it is ultimately responsible for everything that takes place within a company. Therefore, it must continually ensure that data and resources are being properly protected. 6. B. Standards are rules that must be followed; thus, they are compulsory. Guidelines are recommendations, while procedures are step-by-step instructions. 7. A. Without senior management’s support, a security program will not receive the necessary attention, funds, resources, and enforcement capabilities. 8. D. Companies may decide to live with specific risks they are faced with if the cost of trying to protect themselves would be greater than the potential loss if the threat were to become real. Countermeasures are usually complex to a degree, and there are almost always political issues surrounding different risks, but these are not reasons to not implement a countermeasure.
ch03.indd 152
10/8/2007 1:51:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 3: Information Security and Risk Management
153 9. C. A security policy captures senior management’s perspectives and directives on what role security should play within the company. Security policies are usually general and use broad terms so they can cover a wide range of items. 10. B. Although the other answers may seem correct, B is the best answer here. This is because a risk analysis is performed to identify risks and come up with suggested countermeasures. The ALE tells the company how much it could lose if a specific threat became real. The ALE value will go into the cost/benefit analysis, but the ALE does not address the cost of the countermeasure and the benefit of a countermeasure. All the data captured in answers A, C, and D are inserted into a cost/benefit analysis. 11. D. The ALE calculation estimates the potential loss that can affect one asset from a specific threat within a one-year time span. This value is used to figure out the amount of money that should be earmarked to protect this asset from this threat. 12. A. Three types of goals make up the planning horizon: operational, tactical, and strategic. Tactical goals are midterm goals that must be accomplished before the overall strategic goal is accomplished. 13. A. An exposure is an instance of being exposed to losses from a threat agent. A vulnerability can cause an organization to be exposed to possible damages. For example, if password management is lax and password rules are not enforced, the company can be exposed to the possibility of having users’ passwords captured and used in an unauthorized manner. 14. A. Security is not defined by a firewall, an access control mechanism, a security policy, company procedures, employee conduct, or authentication technologies. It is defined by all of these and how they integrate together within an environment. Security is neither purely technical nor purely procedural, but rather a mix of the two. 15. C. The functionality describes how a mechanism will work and behave. This may have nothing to do with the actual protection it provides. Assurance is the level of confidence in the protection level a mechanism will provide. When systems and mechanisms are evaluated, their functionality and assurance should be examined and tested individually. 16. B. Although answer C may seem correct to you, it is a subjective answer. Businesses will see their threats and risks as being more important than another organization’s threats and risks. The military has a rich history of having to keep its secrets secret. This is usually not as important in the commercial sector relative to the military. 17. D. The equation is more conceptual than practical. It is hard to assign a number to a vulnerability and a threat individually. This equation enables you to look at the potential loss of a specific asset, as well as the controls gap (what the specific countermeasure cannot protect against). What remains is the residual risk, which is what is left over after a countermeasure is implemented.
ch03.indd 153
10/8/2007 1:51:17 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
154 18. A. The other three answers are the main reasons to carry out a risk analysis. An analysis is not carried out to delegate responsibilities. Management will take on this responsibility once the results of the analysis are reported to it and it understands what actually needs to be carried out. 19. B. The number one ingredient management must provide when it comes to security is support. Management should define the role and scope of security and allocate the funds and resources. Management also delegates who does what pertaining to security. It does not carry out the analysis, but rather is responsible for making sure one is done and that management acts on the results it provides. 20. C. An analysis is only as good as the data that goes into it. Data pertaining to risks the company faces should be extracted from the people who understand best the business functions and environment of the company. Each department understands its own threats and resources, and may have possible solutions to specific threats that affect its part of the company. 21. C. A quantitative risk analysis assigns monetary values and percentages to the different components within the assessment. A qualitative analysis uses opinions of individuals and a rating system to gauge the severity level of different threats and the benefits of specific countermeasures. 22. D. During a risk analysis, the team is trying to properly predict the future and all the risks that future may bring. It is somewhat of a subjective exercise and requires educated guessing. It is very hard to properly predict that a flood will take place once in ten years and cost a company up to $40,000 in damages, but this is what a quantitative analysis tries to accomplish. 23. A. An analysis usually takes a long time to complete because of all the data that must be properly gathered. There are generally many different sources for this type of data, and properly extracting it is extremely time-consuming. In most situations, it involves setting up meetings with specific personnel and going through a question-and-answer process. 24. C. A company’s or individual’s actions can be judged by the “Prudent Person Rule,” which looks at how a prudent or reasonable person would react in similar situations. Due care means to take these necessary actions to protect the company and its assets, customers, and employees. Computer security has many aspects pertaining to practicing due care. If management does not ensure these things are in place, it can be found negligent.
ch03.indd 154
10/8/2007 1:51:18 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CHAPTER
Access Control
4
This chapter presents the following: • Identification methods and technologies • Authentication methods, models, and technologies • Discretionary, mandatory, and nondiscretionary models • Accountability, monitoring, and auditing practices • Emanation security and technologies • Intrusion detection systems • Possible threats to access control practices and technologies
A cornerstone in the foundation of information security is controlling how resources are accessed so they can be protected from unauthorized modification or disclosure. The controls that enforce access control can be technical, physical, or administrative in nature.
Access Controls Overview Access controls are security features that control how users and systems communicate and interact with other systems and resources. They protect the systems and resources from unauthorized access and can be components that participate in determining the level of authorization after an authentication procedure has successfully completed. Although we usually think of a user as the entity that requires access to a network resource or information, there are many other types of entities that require access to other network entities, and resources that are subject to access control. It is important to understand the definition of a subject and an object when working in the context of access control. Access is the flow of information between a subject and an object. A subject is an active entity that requests access to an object or the data within an object. A subject can be a user, program, or process that accesses an object to accomplish a task. When a program accesses a file, the program is the subject and the file is the object. An object is a passive entity that contains information. An object can be a computer, database, file, computer program, directory, or field contained in a table within a database. When you look up information in a database, you are the active subject and the database is the passive object. Figure 4-1 illustrates subjects and objects.
155
ch04.indd 155
10/5/2007 11:48:18 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
156
Figure 4-1 Subjects are active entries that access objects, while objects are passive entities.
Access control is a broad term that covers several different types of mechanisms that enforce access control features on computer systems, networks, and information. Access control is extremely important because it is one of the first lines of defense in battling unauthorized access to systems and network resources. When a user is prompted for a username and password to use a computer, this is access control. Once the user logs in and later attempts to access a file, that file may have a list of users and groups that have the right to access it. If the user is not on this list, the user is denied. This is another form of access control. The users’ permissions and rights may be based on their identity, clearance, and/or group membership. Access controls give organizations the ability to control, restrict, monitor, and protect resource availability, integrity, and confidentiality.
Security Principles The three main security principles for any type of security control are: • Availability • Integrity • Confidentiality These principles, which were touched upon in Chapter 3, will be a running theme throughout this book because each core subject of each chapter approaches these principles in a unique way. In Chapter 3, you read that security management procedures include identifying threats that can negatively affect the availability, integrity, and confidentiality of the company’s assets and finding cost-effective countermeasures that will protect them. This chapter looks at the ways the three principles can be affected and protected through access control methodologies and technologies.
ch04.indd 156
10/5/2007 11:48:31 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
157 Every control that is used in computer and information security provides at least one of these security principles. It is critical that security professionals understand all of the possible ways these principles can be provided and circumvented.
Availability Hey, I’m available. Response: But no one wants you. Information, systems, and resources must be available to users in a timely manner so productivity will not be affected. Most information must be accessible and available to users when requested so they can carry out tasks and fulfill their responsibilities. Accessing information does not seem that important until it is inaccessible. Administrators experience this when a file server goes offline or a highly used database is out of service for one reason or another. Fault tolerance and recovery mechanisms are put into place to ensure the continuity of the availability of resources. User productivity can be greatly affected if requested data is not readily available. Information has various attributes, such as accuracy, relevance, timeliness, and privacy. It may be extremely important for a stockbroker to have information that is accurate and timely, so he can buy and sell stocks at the right times at the right prices. The stockbroker may not necessarily care about the privacy of this information, only that it is readily available. A soft drink company that depends on its soda pop recipe would care about the privacy of this trade secret, and the security mechanisms in place need to ensure this secrecy.
Integrity Information must be accurate, complete, and protected from unauthorized modification. When a security mechanism provides integrity, it protects data, or a resource, from being altered in an unauthorized fashion. If any type of illegitimate modification does occur, the security mechanism must alert the user or administrator in some manner. One example is when a user sends a request to her online bank account to pay her $24.56 water utility bill. The bank needs to be sure the integrity of that transaction was not altered during transmission, so the user does not end up paying the utility company $240.56 instead. Integrity of data is very important. What if a confidential e-mail was sent from the Secretary of State to the President of the United States and was intercepted and altered without a security mechanism in place that disallows this or alerts the President that this message has been altered? Instead of receiving a message reading, “We would love for you and your wife to stop by for drinks tonight,” the message could be altered to say, “We have just bombed Libya.” Big difference.
Confidentiality This is my secret and you can’t have it. Response: I don’t want it. Confidentiality is the assurance that information is not disclosed to unauthorized individuals, programs, or processes. Some information is more sensitive than other information and requires a higher level of confidentiality. Control mechanisms need to be in
ch04.indd 157
10/5/2007 11:48:32 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
158 place to dictate who can access data and what the subject can do with it once they have accessed it. These activities need to be controlled, audited, and monitored. Examples of information that could be considered confidential are health records, financial account information, criminal records, source code, trade secrets, and military tactical plans. Some security mechanisms that would provide confidentiality are encryption, logical and physical access controls, transmission protocols, database views, and controlled traffic flow. It is important for a company to identify the data that must be classified so the company can ensure that the top priority of security protects this information and keeps it confidential. If this information is not singled out, too much time and money can be spent on implementing the same level of security for critical and mundane information alike. It may be necessary to configure virtual private networks (VPNs) between organizations and use the IPSec encryption protocol to encrypt all messages passed when communicating about trade secrets, sharing customer information, or making financial transactions. This takes a certain amount of hardware, labor, funds, and overhead. The same security precautions are not necessary when communicating that today’s special in the cafeteria is liver and onions with a roll on the side. So, the first step in protecting data’s confidentiality is to identify which information is sensitive and to what degree, and then implement security mechanisms to protect it properly. Different security mechanisms can supply different degrees of availability, integrity, and confidentiality. The environment, the classification of the data that is to be protected, and the security goals must be evaluated to ensure the proper security mechanisms are bought and put into place. Many corporations have wasted a lot of time and money not following these steps and instead buying the new “gee whiz” product that recently hit the market.
Identification, Authentication, Authorization, and Accountability For a user to be able to access a resource, he first must prove he is who he claims to be, has the necessary credentials, and has been given the necessary rights or privileges to perform the actions he is requesting. Once these steps are completed successfully, the user can access and use network resources; however, it is necessary to track the user’s activities and enforce accountability for his actions. Identification describes a method of ensuring that a subject (user, program, or process) is the entity it claims to be. Identification can be provided with the use of a username or account number. To be properly authenticated, the subject is usually required to provide a second piece to the credential set. This piece could be a password, passphrase, cryptographic key, personal identification number (PIN), anatomical attribute, or token. These two credential items are compared to information that has been previously stored for this subject. If these credentials match the stored information, the subject is authenticated. But we are not done yet. Once the subject provides its credentials and is properly identified, the system it is trying to access needs to determine if this subject has been given the necessary rights and privileges to carry out the requested actions. The system will look at some type of access control matrix or compare security labels to verify that this subject may indeed access the requested resource and perform the actions it is attempting. If the system determines that the subject may access the resource, it authorizes the subject.
ch04.indd 158
10/5/2007 11:48:32 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
159 Race Condition A race condition is when processes carry out their tasks on a shared resource in an incorrect order. A race condition is possible when two or more processes use a shared resource, as in data within a variable. It is important that the processes carry out their functionality in the correct sequence. If process 2 carried out its task on the data before process 1, the result will be much different than if process 1 carried out its tasks on the data before process 2. In software, when the authentication and authorization steps are split into two functions, there is a possibility an attacker could use a race condition to force the authorization step to be completed before the authentication step. This would be a flaw in the software that the attacker has figured out how to exploit. A race condition occurs when two or more processes use the same resource and the sequences of steps within the software can be carried out in an improper order, something which can drastically affect the output. So, an attacker can force the authorization step to take place before the authentication step and gain unauthorized access to a resource. Although identification, authentication, authorization, and accountability have close and complementary definitions, each has distinct functions that fulfill a specific requirement in the process of access control. A user may be properly identified and authenticated to the network, but he may not have the authorization to access the files on the file server. On the other hand, a user may be authorized to access the files on the file server, but until she is properly identified and authenticated, those resources are out of reach. Figure 4-2 illustrates the four steps that must happen for a subject to access an object. The subject needs to be held accountable for the actions taken within a system or domain. The only way to ensure accountability is if the subject is uniquely identified and the subject’s actions are recorded.
Figure 4-2 Four steps must happen for a subject to access an object: identification, authentication, authorization, and accountability.
ch04.indd 159
10/5/2007 11:48:33 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
160 Logical access controls are tools used for identification, authentication, authorization, and accountability. They are software components that enforce access control measures for systems, programs, processes, and information. The logical access controls can be embedded within operating systems, applications, add-on security packages, or database and telecommunication management systems. It can be challenging to synchronize all access controls and ensure all vulnerabilities are covered without producing overlaps of functionality. However, if it were easy, security professionals would not be getting paid the big bucks! NOTE The words “logical” and “technical” can be used interchangeably in this context. It is conceivable that the CISSP exam would refer to logical and technical controls interchangeably. An individual’s identity must be verified during the authentication process. Authentication usually involves a two-step process: entering public information (a username, employee number, account number, or department ID), and then entering private information (a static password, smart token, cognitive password, one-time password, PIN, or digital signature). Entering public information is the identification step, while entering private information is the authentication step of the two-step process. Each technique used for identification and authentication has its pros and cons. Each should be properly evaluated to determine the right mechanism for the correct environment. NOTE A cognitive password is based on a user’s opinion or life experience. The password could be a mother’s maiden name, a favorite color, or a dog’s name.
References • FWPro Secure Coding Standards http://pageblocks.org/refc/refc_security • “What Are Race Conditions and Deadlocks?” Microsoft Knowledge Base Article 317723 http://support.microsoft.com/kb/317723
Identification and Authentication Now, who are you again? Once a person has been identified, through the user ID or a similar value, she must be authenticated, which means she must prove she is who she says she is. Three general factors can be used for authentication: something a person knows, something a person has, and something a person is. They are also commonly called authentication by knowledge, authentication by ownership, and authentication by characteristic. Verification 1:1 is the measurement of an identity against a single claimed identity. The conceptual question is, “Is this person who he claims to be?” So if Bob provides his identity and credential set, this information is compared to the data kept in an authentication database. If they match, we know that it is really Bob. If the identification is 1: N (many), the measurement of a single identity is compared against multiple identi-
ch04.indd 160
10/5/2007 11:48:33 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
161 ties. The conceptual question is, “Who is this person?” An example is if fingerprints were found at a crime scene, the cops would run them through their database to identify the suspect. Something a person knows (authentication by knowledge) can be, for example, a password, PIN, mother’s maiden name, or the combination to a lock. Authenticating a person by something that she knows is usually the least expensive to implement. The downside to this method is that another person may acquire this knowledge and gain unauthorized access to a system or facility. Something a person has (authentication by ownership) can be a key, swipe card, access card, or badge. This method is common for accessing facilities, but could also be used to access sensitive areas or to authenticate systems. A downside to this method is that the item can be lost or stolen, which could result in unauthorized access. Something specific to a person (authentication by characteristic) becomes a bit more interesting. This is not based on whether the person is a Republican, a Martian, or a moron—it is based on a physical attribute. Authenticating a person’s identity based on a unique physical attribute is referred to as biometrics. (For more information, see the upcoming section, “Biometrics.”) Strong authentication contains two out of these three methods: something a person knows, has, or is. Using a biometric system by itself does not provide strong authentication because it provides only one out of the three methods. Biometrics supplies what a person is, not what a person knows or has. For a strong authentication process to be in place, a biometric system needs to be coupled with a mechanism that checks for one of the other two methods. For example, many times the person has to type a PIN number into a keypad before the biometric scan is performed. This satisfies the “what the person knows” category. Conversely, the person could be required to swipe a magnetic card through a reader prior to the biometric scan. This would satisfy the “what the person has” category. Whatever identification system is used, for strong authentication to be in the process, it must include two out of the three categories. This is also referred to as two-factor authentication. Identity is a complicated concept with many varied nuances, ranging from the philosophical to the practical. A person can have multiple digital identities. For example, a user can be JPublic in a Windows domain environment, JohnP on a Unix server, JohnPublic on the mainframe, JJP in instant messaging, JohnCPublic in the certification authority, and IWearPanties at myspace.com. If a company would want to centralize all of its access control, these various identity names for the same person may put the security administrator into a mental health institution. Determining identity in security has three key aspects: uniqueness, nondescriptive, and issuance. The first, uniqueness, refers to the identifiers that are specific to an individual, meaning every user must have a unique ID for accountability. Things like fingerprints and retina scans can be considered unique elements in determining identity. Nondescriptive means that neither piece of the credential set should indicate the purpose of that account. For example, a user ID should not be “administrator,” “backup_ operator,” or “CEO.” The third key aspect in determining identity is issuance. These elements are the ones that have been provided by another authority as a means of proving identity. ID cards are a kind of security element that would be considered an issuance form of identification.
ch04.indd 161
10/5/2007 11:48:33 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
162 Identification Component Requirements When issuing identification values to users, the following should be in place: • Each value should be unique, for user accountability. • A standard naming scheme should be followed. • The value should be nondescriptive of the user’s position or tasks. • The value should not be shared between users.
Access Control Review The following is a review of the basic concepts in access control: • Identification • Subjects supplying identification information • Username, user ID, account number • Authentication • Verifying the identification information • Passphrase, PIN value, biometric, one-time password, password • Authorization • Using a criteria to make a determination of operations that subjects can carry out on objects • “I know who you are, now what am I going to allow you to do?” • Accountability • Audit logs and monitoring to track user activity
Identity Management There are too many of you who want to access too much stuff. Everyone just go away! Identity management is a broad and loaded term that encompasses the use of different products to identify, authenticate, and authorize users through automated means. To many people, the term also includes user account management, access control, password management, single sign-on functionality, managing rights and permissions for user accounts, and auditing and monitoring of all of these items. The reason that individuals, and companies, have different definitions and perspectives of identity management (IdM) is because it is so large and encompasses so many different technologies and processes. Remember the story of the four blind men who are trying to describe an elephant? One blind man feels the tail and announces, “It’s a tail.” Another blind man feels the trunk and announces, “It’s a trunk.” Another announces it’s a leg, and another announces it’s an ear. This is because each man cannot see or comprehend the whole of the large creature—just the piece he is familiar with and knows about. This analogy can be applied to IdM because it is large and contains many components and many people may not comprehend the whole—only the component they work with and understand.
ch04.indd 162
10/5/2007 11:48:34 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
163 It is important for security professionals to understand not only the whole of IdM, but understand the technologies that make up a full enterprise IdM solution. IdM requires management of uniquely identified entities, their attributes, credentials, and entitlements. IdM allows organizations to create and manage digital identities’ life cycles (create, maintain, terminate) in a timely and automated fashion. The enterprise IdM must meet business needs and scale from internally facing systems to externally facing systems. In this section, we will be covering many of these technologies and how they work together. Selling identity management products is now a flourishing market that focuses on reducing administrative costs, increasing security, meeting regulatory compliance, and improving upon service levels throughout enterprises. The continual increase in complexity and diversity of networked environments only increases the complexity of keeping track of who can access what and when. Organizations have different types of applications, network operating systems, databases, enterprise resource management (ERP) systems, customer relationship management (CRM) systems, directories, mainframes—all used for different business purposes. Then the organizations have partners, contractors, consultants, employees, and temporary employees. (Figure 4-3 actually provides the simplest view of most environments.) Users usually access several different types of systems throughout their daily tasks, which makes controlling access and providing the necessary level of protection on different data types difficult and full of obstacles. This complexity usually results in unforeseen and unidentified holes in asset protection, overlapping and contradictory controls, and policy and regulation noncompliance. It is the goal of identity management technologies to simplify the administration of these tasks and bring order to chaos. The following are many of the common questions enterprises deal with today in controlling access to assets: • What should each user have access to? • Who approves and allows access? • How do the access decisions map to policies? • Do former employees still have access? • How do we keep up with our dynamic and ever-changing environment? • What is the process of revoking access? • How is access controlled and monitored centrally? • Why do employees have eight passwords to remember? • We have five different operating platforms. How do we centralize access when each platform (and application) requires its own type of credential set? • How do we control access for our employees, customers, and partners? • How do we make sure we are compliant with the necessary regulations? • Where do I send in my resignation? I quit. The traditional identity management process has been manual, using directory services with permissions, access control lists (ACLs), and profiles. This approach has
ch04.indd 163
10/5/2007 11:48:34 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
164
Figure 4-3 Most environments are chaotic in terms of access.
proven incapable of keeping up with complex demands and thus has been replaced with automated applications rich in functionality that work together to create an identity management infrastructure. The main goals of identity management (IdM) technologies are to streamline the management of identity, authentication, authorization, and the auditing of subjects on multiple systems throughout the enterprise. The sheer diversity of a heterogonous enterprise makes proper implementation of IdM a huge undertaking. Many identity management solutions and products are available in the marketplace. For the CISSP exam, the following are the types of technologies you should be aware of: • Directories • Web access management • Password management • Legacy single sign-on
ch04.indd 164
10/5/2007 11:48:34 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
165 • Account management • Profile update Directories Most enterprises have some type of directory that contains information pertaining to the company’s network resources and users. Most directories follow a hierarchical database format, based on the X.500 standard, and a type of protocol, as in Lightweight Directory Access Protocol (LDAP), that allows subjects and applications to interact with the directory. Applications can request information about a particular user by making an LDAP request to the directory, and users can request information about a specific resource by using a similar request. The objects within the directory are managed by a directory service. The directory service allows an administrator to configure and manage how identification, authentication, authorization, and access control take place within the network. The objects within the directory are labeled and identified with namespaces. In a Windows environment when you log in, you are logging in to a domain controller (DC), which has a hierarchical directory in its database. The database is running a directory service (Active Directory), which organizes the network resources and carries out user access control functionality. So once you successfully log in to the DC, certain network resources will be available to you (the print service, file server, e-mail server, and so on) as dictated by the configuration of AD. How does the directory service keep all of these entities organized? By using namespaces. Each directory service has a way of identifying and naming the objects they will manage. In databases based on the X.500 standard that are accessed by LDAP, the directory service assigns distinguished names (DNs) to each object. Each DN represents a collection of attributes about a specific object, and is stored in the directory as an entry. In the following example, the DN is made up of a common name (cn) and domain components (dc). Since this is a hierarchical directory, .com is the top, LogicalSecurity is one step down from .com, and Shon is at the bottom (where she belongs). dn: cn=Shon Harris,dc=LogicalSecurity,dc=com cn: Shon Harris
This is a very simplistic example. Companies usually have large trees (directories) containing many levels and objects to represent different departments, roles, users, and resources. A directory service manages the entries and data in the directory and also enforces the configured security policy by carrying out access control and identity management functions. For example, when you log in to the DC, the directory service (AD) will determine what resources you can and cannot access on the network.
ch04.indd 165
10/5/2007 11:48:35 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
166 Organizing All of This Stuff In a database directory based on the X.500 standard, the following rules are used for object organization; • The directory has a tree structure to organize the entries using a parentchild configuration. • Each entry has a unique name made up of attributes of a specific object. • The attributes used in the directory are dictated by the defined schema. • The unique identifiers are called distinguished names. The schema describes the directory structure and what names can be used within the directory, among other things. (Schema and database components are covered more in-depth in Chapter 11.) The following diagram shows how an object (Kathy Conlon) can have the attributes of ou=General ou=NCTSW ou=pentagon ou=locations ou=Navy ou=DoD ou=U.S. Government C=US.
Note that OU stands for organizational unit. They are used as containers of other similar OUs, users, and resources. They provide the parent-child (sometimes called tree-leaf) organization structure.
ch04.indd 166
10/5/2007 11:48:35 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
167 NOTE We touch on directory services again in the “Single Sign-On” section of this chapter.
So are there any problems with using a directory product for identity management and access control? Yes, there’s always something. Many legacy devices and applications cannot be managed by the directory service because they were not built with the necessary client software. The legacy entities must be managed through their inherited management software. This means that most networks have subjects, services, and resources that can be listed in a directory and controlled centrally by an administrator through the use of a directory service. Then there are legacy applications and devices that the administrator must configure and manage individually. The Directories’ Role in Identity Management A directory used for IdM is specialized database software that has been optimized for reading and searching operations. It is the main component of an identity management solution. This is because all resource information, users’ attributes, authorization profiles, roles, potential access control policies, and more are stored in this one location. When other IdM software applications need to carry out their functions (authorization, access control, assigning permissions), they now have a centralized location for all of the information they need. As an analogy, let’s say I’m a store clerk and you enter my store to purchase alcohol. Instead of me having to find a picture of you somewhere to validate your identity, go to another place to find your birth certificate to obtain your true birth date, and find proof of which state you are registered in, I can look in one place—your driver’s license. The directory works in the same way. Some IdM application may need to know a user’s authorization rights, role, employee status, or clearance level, so instead of this application having to make requests to several databases and other applications, it makes its request to this one directory. A lot of the information stored in an IdM directory is scattered throughout the enterprise. User attribute information (employee status, job description, department, and so on) is usually stored in the HR database, authentication information could be in a Kerberos server, role and group identification information might be in a SQL database, and resource-oriented authentication information is stored in Active Directory on a domain controller. These are commonly referred to as identity stores and are located in different places on the network. Something nifty that many identity management products do is create meta-directories or virtual directories. A meta-directory gathers the necessary information from multiple sources and stores them in one central directory. This provides a unified view of all users’ digital identity information throughout the enterprise. The meta-directory synchronizes itself with all of the identity stores periodically to ensure the most up-to-date information is being used by all applications and IdM components within the enterprise. A virtual directory plays the same role and can be used instead of a meta-directory. The difference between the two is that the meta-directory physically has the identity data in its directory, whereas a virtual directory does not and points to where the actual data resides. When an IdM component makes a call to a virtual directory to gather identity information on a user, the virtual directory will point to where the information actually lives.
ch04.indd 167
10/5/2007 11:48:35 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
168 Figure 4-4 illustrates a central LDAP directory that is used by the IdM services: access management, provisioning, and identity management. When one of these services accepts a request from a user or application, it pulls the necessary data from the directory to be able to fulfill the request. Since the data needed to properly fulfill these requests are stored in different locations, the metadata directory pulls the data from these other sources and updates the LDAP directory. Web Access Management Web access management (WAM) software controls what users can access when using a web browser to interact with web-based enterprise assets. This type of technology is continually becoming more robust and experiencing increased deployment. This is because of the increased use of e-commerce, online banking, content providing, web services, and more. The Internet only continues to grow and its importance to businesses and individuals increases as more and more functionality is provided. We just can’t seem to get enough of it. Figure 4-5 shows the basic components and activities in a web access control management process. 1. User sends in credentials to web server. 2. Web server validates user’s credentials. 3. User requests to access a resource (object). 4. Web server verifies with the security policy to determine if the user is allowed to carry out this operation. 5. Web server allows access to the requested resource.
Figure 4-4 Meta-directories pull data from other sources to populate the IdM directory.
ch04.indd 168
10/5/2007 11:48:36 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
169
Figure 4-5 A basic example of web access control
This is a simple example. More complexity comes in with all the different ways a user can authenticate (password, digital certificate, token, and others), the resources and services that may be available to the user (transfer funds, purchase product, update profile, and so forth) and the necessary infrastructure components. The infrastructure is usually made up of a web server farm (many servers), a directory that contains the users’ accounts and attributes, a database, a couple of firewalls, and some routers, all laid out in a tiered architecture. But let’s keep it simple right now. The WAM software is the main gate between users and the corporate web-based resources. It is commonly a plug-in for a web server, so it works as a front-end process. When a user makes a request for access, the web server software will query a directory (described in the last section), an authentication server, and potentially a back-end database before serving up the resource the user requested. The WAM console allows the administrator to configure access levels, authentication requirements, and account setup workflow steps, and to perform overall maintenance. WAM tools usually also provide a single sign-on capability so that once a user is authenticated at a web site, she can access different web-based applications and resources without having to log in multiple times. When a product provides a single sign-on capability in a web environment, the product must keep track of the user’s authentication state and security context as the user moves from one resource to the next. For example, if Kathy logs on to her online bank web site, the communication is taking place over the HTTP protocol. This protocol itself is stateless, which means it will allow a web server to pass the user a web page and then the connection is closed and the user is forgotten about. Many web servers work in a stateless mode because they have so many requests to fulfill and they are just providing users with web pages. Keeping a constant connection with each and every user who is requesting to see a web page would exhaust the web server’s resources. When a user has to log on to a web site is when “keeping the user’s state” is required and a continuous connection is needed.
ch04.indd 169
10/5/2007 11:48:36 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
170 When Kathy first goes to her bank’s web site, she is viewing publicly available data that do not require her to authenticate before viewing. A constant connection is not being kept by the web server, thus it is working in a stateless manner. Once she clicks Access My Account, the web server sets up a secure connection (SSL) with her browser and requests her credentials. After she is authenticated, the web server sends a cookie (small text file) that indicates she has authenticated properly and the type of access she should be allowed. When Kathy requests to move from her savings account to her checking account, the web server will assess the cookie on Kathy’s web browser to see if she has the rights to access this new resource. The web server continues to check this cookie during Kathy’s session to ensure no one has hijacked the session and that the web server is continually communicating with Kathy’s system and not someone else’s. The web server continually asks Kathy’s web browser to prove she has been authenticated, which the browser does by providing the cookie information. (The cookie information could include her password, account number, security level, browsing habits, and/or personalization information.) As long as Kathy is authenticated, the web server software will keep track of each of her requests, log her events, and make changes that she requests that can take place in her security context. Security context is the authorization level she is assigned based on her permissions, entitlements, and access rights. Once Kathy ends the session, the cookie is usually erased from the web browser’s memory and the web server no longer keeps this connection open or collects session state information on this user. NOTE A cookie can be in the format of a text file stored on the user’s hard drive (permanent) or it can be only held in memory (session). If the cookie contains any type of sensitive information, then it should only be held in memory and be erased once the session has completed. As an analogy, let’s say I am following you in a mall as you are shopping. I am marking down what you purchase, where you go, and the requests you make. I know everything about your actions; I document them in a log, and remember them as you continue. (I am keeping state information on you and your activities.) You can have access to all of these stores if you show me a piece of paper that I gave you every 15 minutes. If you fail to show me the piece of paper at the necessary interval, I will push a button and all stores will be locked—you no longer have access to the stores, I no longer collect information about you, and I leave and forget all about you. Since you are no longer able to access any sensitive objects (store merchandise), I don’t need to keep track of you and what you are doing. As long as the web browser serves up the cookie to the web browser, Kathy does not have to provide credentials as she asks for different resources. This is what single signon is. You only have to provide your credentials once and the continual validation that you have the necessary cookie will allow you to go from one resource to another. If you end your session with the web server and need to interact with it again, you must reauthenticate and a new cookie will be sent to your browser and it starts all over again.
ch04.indd 170
10/5/2007 11:48:36 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
171 NOTE We will cover specific single sign-on technologies later in this chapter along with their security issues.
So the WAM product allows an administrator to configure and control access to internal resources. This type of access control is commonly put in place to control external entities requesting access. The product may work on a single web server or a server farm. Password Management Wouldn’t it be easier for everyone to just use the value “password” for their password? Response: Yes! Let’s do that, and then no password management will ever be needed. We cover password requirements, security issues, and best practices later in this chapter. At this point, we need to understand how password management can work within an IdM environment. Help-desk workers and administrators commonly complain about the amount of time they have to spend resetting passwords when users forget them. Another issue is the amount of different passwords the users are required to remember for the different platforms within the network. When a password changes, an administrator must connect directly to that management software of the specific platform and change the password value. This may not seem like much of a hassle, but if an organization has 4000 users and seven different platforms, and 35 different applications, it could require a full-time person to continually make these password modifications. And who would really want that job? Different types of password management technologies have been developed to get these pesky users off the backs of IT and the help desk by providing a more secure and automated password management system. The most common password management approaches are listed next. • Password Synchronization Reduces the complexity of keeping up with different passwords for different systems. • Self-Service Password Reset Reduces help-desk call volumes by allowing users to reset their own passwords. • Assisted Password Reset Reduces the resolution process for password issues for the help desk. This may include authentication with other types of authentication mechanisms (biometrics, tokens). Password Synchronization If users have too many passwords they need to keep track of, they will write the passwords down on a sticky note and cleverly hide this under their keyboard or just stick it on the side of their monitor. This is certainly easier for the user, but not so great for security. Password synchronization technologies can allow a user to maintain just one password across multiple systems. The product will synchronize the password to other systems and applications, which happens transparently to the user.
ch04.indd 171
10/5/2007 11:48:37 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
172 The goal is to require the user to memorize only one password and have the ability to enforce more robust and secure password requirements. If a user only needs to remember one password, he is more likely to not have a problem with longer, more complex strings of values. This reduces help-desk call volume and allows the administrator to keep her sanity for just a little bit longer. One criticism of this approach is that since only one password is used to access different resources, now the hacker only has to figure out one credential set to gain unauthorized access to all resources. But if the password requirements are more demanding (12 characters, no dictionary words, three symbols, upper and lower letters, and so on) and the password is changed out regularly, the balance between security and usability can be acceptable. Self-Service Password Reset Some products are implemented to allow users to reset their own passwords. This does not mean that the users have any type of privileged permissions on the systems to allow them to change their own credentials. Instead, during the registration of a user account, the user can be asked to provide several personal questions (school graduated from, favorite teacher, favorite color, and so on) in a question and answer form. When the user forgets his password, he may be required to provide another authentication mechanism (smart card, token) and to answer these previously answered questions to prove his identity. If he does this properly, he is allowed to change his password. If he does not do this properly, he is fired because he is an idiot. Products are available that allow users to change their passwords through other means. For example, if you forgot your password, you may be asked to answer some of the questions answered during the registration process of your account. If you do this correctly, an e-mail is sent to you with a link you must click. The password management product has your identity tied to the answers you gave to the questions during your account registration process and to your e-mail address. If the user does everything correctly, he is given a screen that allows him to reset his password. CAUTION The product should not ask for information that is publicly available, as in your mother’s maiden name, because anyone can find that out and attempt to identify himself as you. Assisted Password Reset Some products are created for help-desk employees who need to work with individuals when they forget their password. The help-desk employee should not know or ask the individual for her password. This would be a security risk since only the owner of the password should know the value. The helpdesk employee also should not just change a password for someone calling in without authenticating that person first. This can allow social engineering attacks where an attacker calls the help desk and indicates she is someone who she is not. If this took place, then an attacker would have a valid employee password and can gain unauthorized access to the company’s jewels. The products that provide assisted password reset functionality allow the help-desk individual to authenticate the caller before resetting the password. This authentication process is commonly performed through the question and answer process described in the previous section. The help-desk individual and the caller must be identified and
ch04.indd 172
10/5/2007 11:48:37 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
173 authenticated through the password management tool before the password can be changed. Once the password is updated, the system that the user is authenticating to should require the user to change her password again. This would ensure that only she (and not she and the help-desk person) knows her password. The goal of an assisted password reset product is to reduce the cost of support calls and ensure all calls are processed in a uniform, consistent, and secure fashion. Various password management products on the market provide one or all of these functionalities. Since IdM is about streamlining identification, authentication, and access control, one of these products is typically integrated into the enterprise IdM solution. Legacy Single Sign-On We will cover specific single sign-on (SSO) technologies later in this chapter, but at this point we want to understand how SSO products are commonly used as an IdM solution, or part of a larger IdM enterprise-wide solution. An SSO technology allows a user to authenticate one time and then access resources in the environment without needing to re-authenticate. This may sound the same as password synchronization, but it is not. With password synchronization, a product takes the user’s password and updates each user account on each different system and application with that one password. If Tom’s password is iwearpanties, then this is the value he must type into each and every application and system he must access. In an SSO situation, Tom would send his password to one authentication system. When Tom requests to access a network application, the application will send over a request for credentials, but the SSO software will respond to the application for Tom. So in SSO environments, the SSO software intercepts the login prompts from network systems and applications and fills in the necessary identification and authentication information (that is, the username and password) for the user. Even though password synchronization and single sign-on are different technologies, they still have the same vulnerability. If an attacker uncovers a user’s credential set, she can have access to all the resources that the legitimate user may have access to. An SSO solution may also provide a bottleneck or single point of failure. If the SSO server goes down, users are unable to access network resources. This is why it’s a good idea to have some type of redundancy or fail-over technology in place. Most environments are not homogeneous in devices and applications, which makes it more difficult to have a true enterprise SSO solution. Legacy systems many times require a different type of authentication process than the SSO software can provide. So potentially 80 percent of the devices and applications may be able to interact with the SSO software and the other 20 percent will require users to authenticate to them directly. In many of these situations, the IT department may come up with their own homemade solutions, such as using login batch scripts for the legacy systems. Are there any other downfalls with SSO we should be aware of? Well, it can be expensive to implement, especially in larger environments. Many times companies evaluate purchasing this type of solution and find out it is too cost prohibitive. The other issue is that it would mean all of the users’ credentials for the company’s resources are stored in one location. If an attacker was able to break in to this storehouse, she could access whatever she wanted, and do whatever she wanted, with the company’s assets. As always, security, functionality, and cost must be properly weighed to determine the best solution for the company.
ch04.indd 173
10/5/2007 11:48:37 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
174 Account Management Account management is often not performed efficiently and effectively in companies today. Account management deals with creating user accounts on all systems, modifying the account privileges when necessary, and decommissioning the accounts when they are no longer needed. Most environments have their IT department create accounts manually on the different systems, users are given excessive rights and permissions, and when an employee leaves the company, many or all of the accounts stay active. This is because a centralized account management technology has not been put into place. Account management products attempt to attack these issues by allowing an administrator to manage user accounts across multiple systems. When there are multiple directories containing user profiles or access information, the account management software allows for replication between the directories to ensure each contains the same up-to-date information. Now let’s think about how accounts are set up. In many environments, when a new user needs an account, a network administrator will set up the account(s) and provide some type of privileges and permissions. But how would the network administrator know what resources this new user should have access to and what permissions should be assigned to the new account? In most situations, he doesn’t—he just wings it. This is how users end up with too much access to too much stuff. What should take place instead is implementing a workflow process that allows for a request for a new user account. This request is approved, usually, by the employee’s manager, and the accounts are automatically set up on the systems, or a ticket is generated for the technical staff to set up the account(s). If there is a request for a change to the permissions on the account or if an account needs to be decommissioned, it goes through the same process. The request goes to a manager (or whoever is delegated with this approval task), the manager approves it, and the changes to the various accounts take place. The automated workflow component is common in account management products that provide IdM solutions. Not only does this reduce the potential errors that can take place in account management, each step (including account approval) is logged and tracked. This allows for accountability and provides documentation for use in backtracking if something goes wrong. It also helps ensure that only the necessary amount of access is provided to the account and that there are no “orphaned” accounts still active when employees leave the company. In addition, these types of processes are the kind your auditors will be looking for—and we always want to make the auditors happy! NOTE These types of account management products are commonly used to set up and maintain internal accounts. Web access control management is used mainly for external users. As with SSO products, enterprise account management products are usually expensive and can take years to properly roll out across the enterprise. Regulatory requirements, however, are making more and more companies spend the money for these types of solutions—which the vendors love!
ch04.indd 174
10/5/2007 11:48:38 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
175 Provisioning Let’s review what we know, and then build upon these concepts. Most IdM solutions pull user information from the HR database, because this data are already collected and held in one place and are constantly updated as employee or contractors’ statuses change. So user information will be copied from the HR database (referred to as the authoritative source) into a directory, which we covered in an early section. When a new employee is hired, the employee’s information, along with his manager’s name, is pulled from the HR database into the directory. The employee’s manager is automatically sent an e-mail asking for approval of this new account. After the manager approves, the necessary accounts are set up on the required systems. Over time, this new user will commonly have different identity attributes, which will be used for authentication purposes, stored in different systems in the network. When a user requests access to a resource, all of his identity data has already been copied from other identity stores and the HR database and held in this centralized directory (sometimes called the identity repository). This may be a meta-directory or a virtual directory. The access control component of the IdM system will compare the user’s request to the IdM access control policy and ensure the user has the necessary identification and authentication pieces in place before allowing access to the resource. When this employee is fired, this new information goes from the HR database to the directory. An e-mail is automatically generated and sent to the manager to allow this account to be decommissioned. Once this is approved, the account management software disables all of the accounts that had been set up for this user. This example illustrates user account management and provisioning, which is the life-cycle management of identity components. Why do we have to worry about all of this identification and authentication stuff? Because users always want something—they are very selfish. Okay, users actually need access to resources to carry out their jobs. But what do they need access to, and what level of access? This question is actually a very difficult one in our distributed, heterogeneous, and somewhat chaotic environments today. Too much access to resources opens the company up to potential fraud and other risks. Too little access means the user cannot do his job. So we are required to get it just right. User provisioning refers to the creation, maintenance, and deactivation of user objects and attributes as they exist in one or more systems, directories, or applications, in response to business processes. User provisioning software may include one or more of the following components: change propagation, self-service workflow, consolidated user administration, delegated user administration, and federated change control. User objects may represent employees, contractors, vendors, partners, customers, or other recipients of a service. Services may include electronic mail, access to a database, access to a file server or mainframe, and so on. Great. So we create, maintain, and deactivate accounts as required based on business needs. What else does this mean? The creation of the account also is the creation of the access rights to company assets. It is through provisioning that users are given access, or access is taken away. Throughout the life cycle of a user identity, access rights,
ch04.indd 175
10/5/2007 11:48:38 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
176 permissions, and privileges should change as needed in a clearly understood, automated, and audited process. By now, you should be able to connect how these different technologies work together to provide an organization with streamlined IdM. Directories are built to contain user and resource information. A metadata directory pulls identity information that resides in different places within the network to allow IdM processes to only have to get the needed data for their tasks from this one location. User management tools allow for automated control of user identities through their lifetimes and can provide provisioning. A password management tool is in place so that productivity is not slowed down by a forgotten password. A single sign-on technology requires internal users to only authenticate once for enterprise access. Web access management tools provide a single sign-on service to external users and controls access to web-based resources. Figure 4-6 provides a visual example of how many of these components work together. Profile Update Most companies do not just contain the information “Bob Smith” for a user and make all access decisions based off of this data. There can be a plethora of information on a user that is captured (e-mail address, home address, phone number, panty size, and so on). When this collection of data is associated with the identity of a user, we call it a profile.
Figure 4-6 Identity management components
ch04.indd 176
10/5/2007 11:48:38 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
177 The profile should be centrally located for easier management. IdM enterprise solutions have profile update technology that allows an administrator to create, make changes, or delete these profiles in an automated fashion when necessary. Many user profiles contain nonsensitive data that the user can update himself (called self service). So if George moved to a new house, there should be a profile update tool that allows him to go into his profile and change his address information. Now, his profile may also contain sensitive data that should not be available to George—for example, his access rights to resources or information that he is going to get laid off on Friday. You have interacted with a profile update technology if you have requested to update your personal information on a web site, as in Orbitz, Amazon, or Expedia. These companies provide you with the capability to sign in and update the information they allow you to access. This could be your contact information, home address, purchasing preferences, or credit card data. This information is then used to update their customer relationship management (CRM) system so they know where to send you their junk mail advertisements or spam messages.
Digital Identity An interesting little fact that not many people are aware of is that a digital identity is made up of attributes, entitlements, and traits. Many of us just think of identity as a user ID that is mapped to an individual. The truth is that it is usually more complicated than that. A user’s identity can be a collection of her attributes (department, role in company, shift time, clearance, and others), her entitlements (resources available to her, authoritative rights in the company, and so on) and her traits (biometric information, height, sex, and so forth). So if a user requests access to a database that contains sensitive employee information, the IdM solution would need to pull together the necessary identity information and her supplied credentials before she is authorized access. If the user is a senior manager (attribute), with a Secret clearance (attribute), and has access to the database (entitlement)—she is granted the permissions Read and Write to certain records in the database Monday through Friday, 8 A.M. to 5 P.M. (attribute). Another example is if a soldier requests to be assigned an M-16 firearm. She must be in the 34th division (attribute), have a Top Secret clearance (attribute), her supervisor must have approved this (entitlement), and her physical features (traits) must match the ID card she presents to the firearm depot clerk. The directory (or meta-directory) of the IdM system has all of this identity information centralized, which is why it is so important. Many people think that just logging in to a domain controller or a network access server is all that is involved in identity management. But if you peek under the covers, you can find an array of complex processes and technologies working together. The CISSP exam is not currently getting into this level of detail (entitlement, attribute, traits) pertaining to IdM, but in the real world there are many facets to identification, authentication, authorization, and auditing that make it a complex beast.
ch04.indd 177
10/5/2007 11:48:39 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
178 Federation The world continually gets smaller as technology brings people and companies closer together. Many times, when we are interacting with just one web site, we are actually interacting with several different companies—we just don’t know it. The reason we don’t know it is because these companies are sharing our identity and authentication information behind the scenes. This is not done for nefarious purposes necessarily, but to make our lives easier and to allow merchants to sell their goods without much effort on our part. For example, a person wants to book an airline flight and a hotel room. If the airline company and hotel company use a federated identity management system, this means they have set up a trust relationship between the two companies and will share customer identification and, potentially, authentication information. So when I book my flight on Southwest, the web site asks me if I want to also book a hotel room. If I click “Yes,” I could then be brought to the Hilton web site, which provides me with information on the closest hotel to the airport I’m flying into. Now, to book a room I don’t have to log in again. I logged in on the Southwest web site, and that web site sent my information over to the Hilton web site, all of which happened transparently to me. A federated identity is a portable identity, and its associated entitlements, that can be used across business boundaries. It allows a user to be authenticated across multiple IT systems and enterprises. Identity federation is based upon linking a user’s otherwise distinct identities at two or more locations without the need to synchronize or consolidate directory information. Federated identity offers businesses and consumers a more convenient way of accessing distributed resources and is a key component of e-commerce. NOTE Federation identity and all of the IdM technologies we have discussed so far are usually more complex than what has been presented in this text. This is just the “one-inch deep” overview that the CISSP exam expects of test takers. To get more in-depth information on IdM, visit the author’s web site at www.logicalsecurity.com/IdentityManagement.
Who Needs Identity Management? The following are good indications that an identity management solution might be right for your company: • If users have more than six username and password combinations • If it takes more than one day to set up and provision an account for new employees • If it takes more than one day to revoke all access and disable the account of a terminated employee • If access to critical resources cannot be restricted • If access to critical resources cannot be audited or monitored
The following sections explain the various types of authentication methods commonly used and integrated in many identity management processes and products today.
ch04.indd 178
10/5/2007 11:48:39 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
179 References • Identity Management www.opengroup.org/projects/idm/uploads/40/9784/ idm_wp.pdf • Work Papers www.ec3.org/Pubs/PubWGPapersYr.htm • Identity Management http://en.wikipedia.org/wiki/Identity_management • EDUCASE Core Content www.educause.edu/content.asp?page_ id=645&PARENT_ID=679&bhcp=1
Biometrics I would like to prove who I am. Please look at the blood vessels at the back of my eyeball. Response: Gross. Biometrics verifies an individual’s identity by analyzing a unique personal attribute or behavior, which is one of the most effective and accurate methods of verifying identification. Biometrics is a very sophisticated technology; thus, it is much more expensive and complex than the other types of identity verification processes. A biometric system can make authentication decisions based on an individual’s behavior, as in signature dynamics, but these can change over time and possibly be forged. Biometric systems that base authentication decisions on physical attributes (such as iris, retina, or fingerprint) provide more accuracy, because physical attributes typically don’t change, absent of some disfiguring injury, and are harder to impersonate. Biometrics is typically broken up into two different categories. The first is the physiological. These are traits that are physical attributes unique to a specific individual. Fingerprints are a common example of a physiological trait used in biometric systems. The second category of biometrics is known as behavioral. This is based on a characteristic of an individual to confirm his identity. An example is signature dynamics. Physiological is “what you are” and behavioral is “what you do.” A biometric system scans a person’s physiological attribute or behavioral trait and compares it to a record created in an earlier enrollment process. Because this system inspects the grooves of a person’s fingerprint, the pattern of someone’s retina, or the pitches of someone’s voice, it must be extremely sensitive. The system must perform accurate and repeatable measurements of anatomical or behavioral characteristics. This type of sensitivity can easily cause false positives or false negatives. The system must be calibrated so these false positives and false negatives occur infrequently and the results are as accurate as possible. When a biometric system rejects an authorized individual, it is called a Type I error (false rejection rate). When the system accepts impostors who should be rejected, it is called a Type II error (false acceptance rate). The goal is to obtain low numbers for each type of error, but Type II errors are the most dangerous and thus the most important to avoid. When comparing different biometric systems, many different variables are used, but one of the most important metrics is the crossover error rate (CER). This rating is stated as a percentage and represents the point at which the false rejection rate equals the false acceptance rate. This rating is the most important measurement when determining the system’s accuracy. A biometric system that delivers a CER of 3 will be more accurate than a system that delivers a CER of 4.
ch04.indd 179
10/5/2007 11:48:39 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
180 NOTE
Crossover error rate (CER) is also called equal error rate (EER).
What is the purpose of this CER value anyway? Using the CER as an impartial judgment of a biometric system helps create standards by which products from different vendors can be fairly judged and evaluated. If you are going to buy a biometric system, you need a way to compare the accuracy between different systems. You can just go by the different vendors’ marketing material (they all say they are the best), or you can compare the different CER values of the products to see which one really is more accurate than the others. It is also a way to keep the vendors honest. One vendor may tell you, “We have absolutely no Type II errors.” This would mean that their product would not allow any imposters to be improperly authenticated. But what if you asked the vendor how many Type I errors their product had and she sheepishly replied, “We average around 90 percent of Type I errors.” That would mean that 90 percent of the authentication attempts would be rejected, which would negatively affect your employees’ productivity. So you can ask about their CER value, which represents when the Type I and Type II errors are equal, to give you a better understanding of the product’s overall accuracy. Individual environments have specific security level requirements, which will dictate how many Type I and Type II errors are acceptable. For example, a military institution that is very concerned about confidentiality would be prepared to accept a certain number of Type I errors, but would absolutely not accept any false accepts (Type II errors). Because all biometric systems can be calibrated, if you lower the Type II error rate by adjusting the system’s sensitivity, it will result in an increase in Type I errors. The military institution would obviously calibrate the biometric system to lower the Type II errors to zero, but that would mean it would have to accept a higher rate of Type I errors. Biometrics is the most expensive method of verifying a person’s identity, and it faces other barriers to becoming widely accepted. These include user acceptance, enrollment timeframe, and throughput. Many times, people are reluctant to let a machine read the pattern of their retina or scan the geometry of their hand. This lack of enthusiasm has slowed down the widespread use of biometric systems within our society. The enrollment phase requires an action to be performed several times to capture a clear and distinctive reference record. People are not particularly fond of expending this time and energy when they are used to just picking a password and quickly typing it into their console. When a person attempts to be authenticated by a biometric system, sometimes the system will request an action to be completed several times. If the system was unable to get a clear reading of an iris scan or could not capture a full voice verification print, the individual may have to repeat the action. This causes low throughput, stretches the individual’s patience, and reduces acceptability. During enrollment, the user provides the biometric data (fingerprint, voice print) and the biometric reader converts this data into binary values. Depending on the system, the reader may create a hash value of the biometric data, or it may encrypt the data, or do both. The biometric data then goes from the reader to a back-end authenti-
ch04.indd 180
10/5/2007 11:48:40 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
181 cation database where her user account has been created. When the user needs to later authenticate to a system, she will provide the necessary biometric data (fingerprint, voice print) and the binary format of this information is compared to what is in the authentication database. If they match, then the user is authenticated. In Figure 4-7, we see that biometric data can be stored on a smart card and used for authentication. Also, you might notice that the match is 95 percent instead of 100 percent. Obtaining a 100 percent match each and every time is very difficult because of the level of sensitivity of the biometric systems. A smudge on the reader, oil on the person’s finger, and other small environmental issues can stand in the way of matching 100 percent. If your biometric system was calibrated so it required 100 percent matches, this would mean you would not allow any Type II errors and that users would commonly not be authenticated in a timely manner.
Processing Speed When reviewing biometric devices for purchase, one component to take into consideration is the length of time it takes to actually authenticate users. From the time a user inserts data until she receives an accept or reject response should take five to ten seconds. The following is an overview of the different types of biometric systems and the physiological or behavioral characteristics they examine.
Figure 4-7 Biometric data is turned into binary data and compared for identity validation.
ch04.indd 181
10/5/2007 11:48:40 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
182 Fingerprint Fingerprints are made up of ridge endings and bifurcations exhibited by friction ridges and other detailed characteristics called minutiae. It is the distinctiveness of these minutiae that gives each individual a unique fingerprint. An individual places his finger on a device that reads the details of the fingerprint and compares this to a reference file. If the two match, the individual’s identity has been verified. NOTE Fingerprint systems store the full fingerprint, which is actually a lot of information that takes up hard drive space and resources. The finger-scan technology extracts specific features from the fingerprint and stores just that information, which takes up less hard drive space and allows for quicker database lookups and comparisons. Palm Scan The palm holds a wealth of information and has many aspects that are used to identify an individual. The palm has creases, ridges, and grooves throughout that are unique to a specific person. The palm scan also includes the fingerprints of each finger. An individual places his hand on the biometric device, which scans and captures this information. This information is compared to a reference file and the identity is either verified or rejected. Hand Geometry The shape of a person’s hand (the length and width of the hand and fingers) defines hand geometry. This trait differs significantly between people and is used in some biometric systems to verify identity. A person places her hand on a device that has grooves for each finger. The system compares the geometry of each finger, and the hand as a whole, to the information in a reference file to verify that person’s identity. Retina Scan A system that reads a person’s retina scans the blood-vessel pattern of the retina on the backside of the eyeball. This pattern has shown to be extremely unique between different people. A camera is used to project a beam inside the eye and capture the pattern and compare it to a reference file recorded previously. Iris Scan The iris is the colored portion of the eye that surrounds the pupil. The iris has unique patterns, rifts, colors, rings, coronas, and furrows. The uniqueness of each of these characteristics within the iris is captured by a camera and compared with the information gathered during the enrollment phase. Of the biometric systems, iris scans are the most accurate. The iris remains constant through adulthood, which reduces the type of errors that can happen during the authentication process. Sampling the iris offers more reference coordinates than any other type of biometric. Mathematically, this means it has a higher accuracy potential than any other type of biometric. NOTE When using an iris pattern biometric system, the optical unit must be positioned so the sun does not shine into the aperture; thus, when implemented, it must have proper placement within the facility. Signature Dynamics When a person signs a signature, usually they do so in the same manner and speed each time. Signing a signature produces electrical signals that can be captured by a biometric system. The physical motions performed when someone is signing a document create these electrical signals. The signals provide unique
ch04.indd 182
10/5/2007 11:48:40 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
183 characteristics that can be used to distinguish one individual from another. Signature dynamics provides more information than a static signature, so there are more variables to verify when confirming an individual’s identity and more assurance that this person is who he claims to be. Signature dynamics is different from a digitized signature. A digitized signature is just an electronic copy of someone’s signature and is not a biometric system that captures the speed of signing, the way the person holds the pen, and the pressure the signer exerts to generate the signature. Keyboard Dynamics Whereas signature dynamics is a method that captures the electrical signals when a person signs a name, keyboard dynamics captures electrical signals when a person types a certain phrase. As a person types a specified phrase, the biometric system captures the speed and motions of this action. Each individual has a certain style and speed, which translate into unique signals. This type of authentication is more effective than typing in a password, because a password is easily obtainable. It is much harder to repeat a person’s typing style than it is to acquire a password. Voice Print People’s speech sounds and patterns have many subtle distinguishing differences. A biometric system that is programmed to capture a voice print and compare it to the information held in a reference file can differentiate one individual from another. During the enrollment process, an individual is asked to say several different words. Later, when this individual needs to be authenticated, the biometric system jumbles these words and presents them to the individual. The individual then repeats the sequence of words given. This technique is used so others cannot attempt to record the session and play it back in hopes of obtaining unauthorized access. Facial Scan A system that scans a person’s face takes many attributes and characteristics into account. People have different bone structures, nose ridges, eye widths, forehead sizes, and chin shapes. These are all captured during a facial scan and compared to an earlier captured scan held within a reference record. If the information is a match, the person is positively identified. Hand Topography Whereas hand geometry looks at the size and width of an individual’s hand and fingers, hand topology looks at the different peaks and valleys of the hand, along with its overall shape and curvature. When an individual wants to be authenticated, she places her hand on the system. Off to one side of the system, a camera snaps a side-view picture of the hand from a different view and angle than that of systems that target hand geometry, and thus captures different data. This attribute is not unique enough to authenticate individuals by itself and is commonly used in conjunction with hand geometry. Biometrics are not without their own sets of issues and concerns. Because they depend upon the specific and unique traits of living things there can be problems that arise. Living things are notorious for not remaining the same, which means they won’t present static biometric information for each and every login attempt. Voice recognition can be hampered by a user with a cold. Pregnancy can change the patterns of the retina. Someone could lose a finger. Or all three could happen. You just never know in this crazy world.
ch04.indd 183
10/5/2007 11:48:41 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
184 Some biometric systems actually check for the pulsation and/or heat of a body part to make sure it is alive. So if you are planning to cut someone’s finger off or pluck out someone’s eyeball so you can authenticate yourself as a legitimate user, it may not work. Although not specifically stated, I am pretty sure this type of activity falls outside the bounds of the CISSP ethics you will be responsible for upholding once you receive your certification.
References • Michigan State University Biometrics Research web site biometrics.cse .msu.edu • The Biometric Consortium home page www.biometrics.org
Passwords User identification coupled with a reusable password is the most common form of system identification and authorization mechanisms. A password is a protected string of characters that is used to authenticate an individual. As stated previously, authentication factors are based on what a person knows, has, or is. A password is something the user knows. Passwords are one of the most often used authentication mechanisms employed today. It is important the passwords are strong and properly managed. Password Management Although passwords are the most commonly used authentication mechanisms, they are also considered one of the weakest security mechanisms available. Why? Users usually choose passwords that are easily guessed (a spouse’s name, a user’s birth date, or a dog’s name), or tell others their passwords, and many times write the passwords down on a sticky note and cleverly hide it under the keyboard. To most users, security is usually not the most important or interesting part of using their computers—except when someone hacks into their computer and steals confidential information, that is. Then security is all the rage. This is where password management steps in. If passwords are properly generated, updated, and kept secret, they can provide effective security. Password generators can be used to create passwords for users. This ensures that a user will not be using “Bob” or “Spot” for a password, but if the generator spits out “kdjasijew284802h,” the user will surely scribble it down on a piece of paper and safely stick it to the monitor, which defeats the whole purpose. If a password generator is going to be used, the tools should create uncomplicated, pronounceable, nondictionary words to help users remember them so they aren’t tempted to write them down. If the users can choose their own passwords, the operating system should enforce certain password requirements. The operating system can require that a password contain a certain number of characters, unrelated to the user ID, include special characters, include upper- and lowercase letters, and not be easily guessable. The operating system can keep track of the passwords a specific user generates so as to ensure no passwords are reused. The users should also be forced to change their passwords periodically. All of these factors make it harder for an attacker to guess or obtain passwords within the environment.
ch04.indd 184
10/5/2007 11:48:41 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
185 If an attacker is after a password, she can try a few different techniques: • Electronic monitoring Listening to network traffic to capture information, especially when a user is sending her password to an authentication server. The password can be copied and reused by the attacker at another time, which is called a replay attack. • Access the password file Usually done on the authentication server. The password file contains many users’ passwords and, if compromised, can be the source of a lot of damage. This file should be protected with access control mechanisms and encryption. • Brute force attacks Performed with tools that cycle through many possible character, number, and symbol combinations to uncover a password. • Dictionary attacks Files of thousands of words are compared to the user’s password until a match is found. • Social engineering An attacker falsely convinces an individual that she has the necessary authorization to access specific resources. • Rainbow tables An attacker uses a table that contains all possible passwords already in a hash format. Certain techniques can be implemented to provide another layer of security for passwords and their use. After each successful logon, a message can be presented to a user indicating the date and time of the last successful logon, the location of this logon, and whether there were any unsuccessful logon attempts. This alerts the user to any suspicious activity, and whether anyone has attempted to log on using his credentials. An administrator can set operating parameters that allow a certain number of failed logon attempts to be accepted before a user is locked out; this is a type of clipping level. The user can be locked out for five minutes or a full day after the threshold (or clipping level) has been exceeded. It depends on how the administrator configures this mechanism. An audit trail can also be used to track password usage and both successful and unsuccessful logon attempts. This audit information should include the date, time, user ID, and workstation the user logged in from. A password’s lifetime should be short but practical. Forcing a user to change a password on a more frequent basis provides more assurance that the password will not be guessed by an intruder. If the lifetime is too short, however, it causes unnecessary management overhead and users may forget which password is active. A balance between protection and practicality must be decided upon and enforced. As with many things in life, education is the key. Password requirements, protection, and generation should be addressed in security-awareness programs so users understand what is expected of them, why they should protect their passwords, and how passwords can be stolen. Users should be an extension to a security team, not the opposition. NOTE Rainbow tables contain passwords already in their hashed format. The attacker just compares a captured hashed password with one that is listed in the table to uncover the plaintext password. This takes much less time than carrying out a dictionary or brute force attack.
ch04.indd 185
10/5/2007 11:48:41 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
186 Password Checkers Several organizations test user-chosen passwords using tools that perform dictionary and/or brute force attacks to detect the weak passwords. This helps make the environment as a whole less susceptible to dictionary and exhaustive attacks used to discover users’ passwords. Many times the same tools employed by an attacker to crack a password are used by a network administrator to make sure the password is strong enough. Most security tools have this dual nature. They are used by security professionals and IT staff to test for vulnerabilities within their environment in the hope of uncovering and fixing them before an attacker finds the vulnerabilities. An attacker uses the same tools to uncover vulnerabilities to exploit before the security professional can fix them. It is the never-ending cat-and-mouse game. If a tool is called a password checker, it is a tool used by a security professional to test the strength of a password. If a tool is called a password cracker, it is usually used by a hacker; however, most of the time, these tools are one and the same. You need to obtain management’s approval before attempting to test (break) employees’ passwords with the intent of identifying weak passwords. Explaining you are trying to help the situation, not hurt it, after you have uncovered the CEO’s password is not a good situation to be in. Password Hashing and Encryption In most situations, if an attacker sniffs your password from the network wire, she still has some work to do before she actually knows your password value, because most systems hash the password with a hashing algorithm, commonly MD4 or MD5, to ensure passwords are not sent in cleartext. In a Windows environment, the passwords are stored in a Security Accounts Management (SAM) database in their hashed version. For extra protection, administrators can use the Syskey utility, which encrypts the database that stores the passwords with a locally stored system key. Syskey can work in three modes, each one increasing the protection provided: • Mode 1 A system key is generated, encrypted, and stored locally. The computer can restart and work normally with no user interaction. • Mode 2 A system key is generated, encrypted, and stored locally, but is password protected. When the computer restarts, the administrator must enter the password to “unlock Syskey,” and this password is not stored locally. • Mode 3 A system key is generated, encrypted, and stored on a floppy disk or CD-ROM. The computer cannot start up properly without a user providing the floppy disk. Although some people think the world is run by Microsoft, other types of operating systems are out there, such as Unix and Linux. These systems do not use registries and SAM databases, but contain their user passwords in a file cleverly called passwd. Now, this passwd file does not contain passwords in cleartext; instead, your password is run through a hashing algorithm, and the resulting value is stored in this file. Unix-type systems zest things up by using salts in this process. Salts are random values added to the encryption process to add more complexity. The more randomness entered into the
ch04.indd 186
10/5/2007 11:48:42 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
187 encryption process, the harder it is for the bad guy to decrypt and uncover your password. The use of a salt means that the same password can be encrypted into 4096 different formats, which makes it much more difficult for an attacker to uncover the right format for your system. Password Aging Many systems enable administrators to set expiration dates for passwords, forcing users to change them at regular intervals. The system may also keep a list of the last five to ten passwords (password history) and not let the users revert back to previously used passwords. Limit Logon Attempts A threshold can be set to allow only a certain number of unsuccessful logon attempts. After the threshold is met, the user’s account can be locked for a period of time or indefinitely, which requires an administrator to manually unlock the account. This protects against dictionary and other exhaustive attacks that continually submit credentials until the right combination of username and password is discovered.
Cognitive Password What is your mother’s name? Response: Shucks, I don’t remember. I have it written down somewhere. Cognitive passwords are fact- or opinion-based information used to verify an individual’s identity. A user is enrolled by answering several questions based on her life experiences. Passwords can be hard for people to remember, but that same person will not likely forget her mother’s maiden name, favorite color, dog’s name, or the school she graduated from. After the enrollment process, the user can answer the questions asked of her to be authenticated, instead of having to remember a password. This authentication process is best for a service the user does not use on a daily basis because it takes longer than other authentication mechanisms. This can work well for help-desk services. The user can be authenticated via cognitive means. This way, the person at the help desk can be sure he is talking to the right person, and the user in need of help does not need to remember a password that may be used once every three months.
One-Time Password A one-time password is also called a dynamic password. It is used for authentication purposes and is only good once. After the password is used, it is no longer valid; thus, if a hacker obtained this password, it could not be reused. This type of authentication mechanism is used in environments that require a higher level of security than static passwords provide. One-time password generating tokens come in two general types: synchronous and asynchronous. The token device generates the one-time password for the user to submit to an authentication server. The following sections explain these concepts. The Token Device The token device, or password generator, is usually a handheld device that has an LCD display and possibly a keypad. This hardware is separate from the computer the user is attempting to access. The token device and authentication
ch04.indd 187
10/5/2007 11:48:42 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
188 SecureID SecureID, from RSA Security, Inc., is one of the most widely used time-based tokens. One version of the product generates the one-time password by using a mathematical function on the time, date, and ID of the token card. Another version of the product requires a PIN to be entered into the token device.
service must be synchronized in some manner to be able to authenticate a user. The token device presents the user with a list of characters to be entered as a password when logging on to a computer. Only the token device and authentication service know the meaning of these characters. Because the two are synchronized, the token device will present the exact password the authentication service is expecting. This is a one-time password, also called a token, and is no longer valid after initial use. Synchronous A synchronous token device synchronizes with the authentication service by using time or a counter as the core piece of the authentication process. If the synchronization is time-based, the token device and the authentication service must hold the same time within their internal clocks. The time value on the token device and a secret key are used to create the one-time password, which is displayed to the user. The user enters this value and a user ID into the computer, which then passes them to the server running the authentication service. The authentication service decrypts this value and compares it to the value it expected. If the two match, the user is authenticated and allowed to use the computer and resources. If the token device and authentication service use counter-synchronization, the user will need to initiate the creation of the one-time password by pushing a button on the
ch04.indd 188
10/5/2007 11:48:42 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
189 token device. This causes the token device and the authentication service to advance to the next authentication value. This value and a base secret are hashed and displayed to the user. The user enters this resulting value along with a user ID to be authenticated. In either time- or counter-based synchronization, the token device and authentication service must share the same secret base key used for encryption and decryption. Asynchronous A token device using an asynchronous token–generating method employs a challenge/response scheme to authenticate the user. In this situation, the authentication server sends the user a challenge, a random value also called a nonce. The user enters this random value into the token device, which encrypts it and returns a value the user uses as a one-time password. The user sends this value, along with a username, to the authentication server. If the authentication server can decrypt the value and it is the same challenge value sent earlier, the user is authenticated, as shown in Figure 4-8. NOTE The actual implementation and process that these devices follow can differ between different vendors. What is important to know is that asynchronous is based on challenge/response mechanisms, while synchronous is based on time-or counter-driven mechanisms. Both token systems can fall prey to masquerading if a user shares his identification information (ID or username) and the token device is shared or stolen. The token device can also have battery failure or other malfunctions that would stand in the way of a successful authentication. However, this type of system is not vulnerable to electronic eavesdropping, sniffing, or password guessing.
Figure 4-8 Authentication using an asynchronous token device includes a workstation, token device, and authentication service.
ch04.indd 189
10/5/2007 11:48:43 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
190 If the user has to enter a password or PIN into the token device before it provides a one-time password, then strong authentication is in effect because it is using two factors—something the user knows (PIN) and something the user has (the token device). NOTE One-time passwords can also be generated in software, in which case a piece of hardware such as a token device is not required. These are referred to as soft tokens and require that the authentication service and application contain the same base secrets, which are used to generate the one-time passwords.
References • RFC 2289 - A One-Time Password System www.faqs.org/rfcs/rfc2289.html • RFC 2444 - The One-Time-Password SASL Mechanism www.faqs.org/rfcs/ rfc2444.html • One-Time Password http://en.wikipedia.org/wiki/One-time_password • RSA SecureID Authentication home page www.rsasecurity.com/node .asp?id=1156
Cryptographic Keys Another way to prove one’s identity is to use a private key by generating a digital signature. A digital signature could be used in place of a password. Passwords are the weakest form of authentication and can be easily sniffed as they travel over a network. Digital signatures are forms of authentication used in environments that require higher security protection than what is provided by passwords. A private key is a secret value that should be in the possession of one person, and one person only. It should never be disclosed to an outside party. A digital signature is a technology that uses a private key to encrypt a hash value (message digest). The act of encrypting this hash value with a private key is called digitally signing a message. A digital signature attached to a message proves the message originated from a specific source, and that the message itself was not changed while in transit. A public key can be made available to anyone without compromising the associated private key; this is why it is called a public key. We explore private keys, public keys, digital signatures, and public key infrastructure (PKI) in Chapter 8, but for now, understand that a private key and digital signatures are other mechanisms that can be used to authenticate an individual.
Passphrase A passphrase is a sequence of characters that is longer than a password (thus a “phrase”) and, in some cases, takes the place of a password during an authentication process. The user enters this phrase into an application and the application transforms the value into a virtual password, making the passphrase the length and format that is required by the application. (For example, an application may require your virtual password to be 128 bits to be used as a key with the AES algorithm.) If a user wants to authenticate
ch04.indd 190
10/5/2007 11:48:43 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
191 to an application, such as Pretty Good Privacy (PGP), he types in a passphrase, let’s say StickWithMeKidAndYouWillWearDiamonds. The application converts this phrase into a virtual password that is used for the actual authentication. The user usually generates the passphrase in the same way a user creates a password the first time he logs on to a computer. A passphrase is more secure than a password because it is longer, and thus harder to obtain by an attacker. In many cases, the user is more likely to remember a passphrase than a password.
Memory Cards The main difference between memory cards and smart cards is their capacity to process information. A memory card holds information but cannot process information. A smart card holds information and has the necessary hardware and software to actually process that information. A memory card can hold a user’s authentication information so the user only needs to type in a user ID or PIN and present the memory card, and if the data that the user entered matches the data on the memory card, the user is successfully authenticated. If the user presents a PIN value, then this is an example of two-factor authentication—something the user knows, and something the user has. A memory card can also hold identification data that are pulled from the memory card by a reader. It travels with the PIN to a back-end authentication server. An example of a memory card is a swipe card that must be used for an individual to be able to enter a building. The user enters a PIN and swipes the memory card through a card reader. If this is the correct combination, the reader flashes green and the individual can open the door and enter the building. Another example is an ATM card. If Buffy wants to withdraw $40 from her checking account, she needs to enter the correct PIN and slide the ATM card (or memory card) through the reader. Memory cards can be used with computers, but they require a reader to process the information. The reader adds cost to the process, especially when one is needed per computer, and card generation adds additional cost and effort to the whole authentication process. Using a memory card provides a more secure authentication method than using a password because the attacker would need to obtain the card and know the correct PIN. Administrators and management must weigh the costs and benefits of a memory token–based card implementation to determine if it is the right authentication mechanism for their environment.
Smart Card My smart card is smarter than your memory card. A smart card has the capability of processing information because it has a microprocessor and integrated circuits incorporated into the card itself. Memory cards do not have this type of hardware and lack this type of functionality. The only function they can perform is simple storage. A smart card, which adds the capability to process information stored on it, can also provide a two-factor authentication method because the user may have to enter a PIN to unlock the smart card. This means the user must provide something she knows (PIN) and something she has (smart card). Two general categories of smart cards are the contact and the contactless types. The contact smart card has a gold seal on the face of the card. When this card is fully
ch04.indd 191
10/5/2007 11:48:44 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
192 inserted into a card reader, electrical fingers wipe against the card in the exact position that the chip contacts are located. This will supply power and data I/O to the chip for authentication purposes. The contactless smart card has an antenna wire that surrounds the perimeter of the card. When this card comes within an electromagnetic field of the reader, the antenna within the card generates enough energy to power the internal chip. Now, the results of the smart card processing can be broadcast through the same antenna, and the conversation of authentication can take place. The authentication can be completed by using a one-time password, by employing a challenge/response value, or by providing the user’s private key if it is used within a PKI environment.
NOTE Two types of contactless smart cards are available: hybrid and combi. The hybrid card has two chips, with the capability of utilizing both the contact and contactless formats. A combi card has one microprocessor chip that can communicate to contact or contactless readers. The information held within the memory of a smart card is not readable until the correct PIN is entered. This fact and the complexity of the smart token make these cards resistant to reverse-engineering and tampering methods. If George loses the smart card he uses to authenticate to the domain at work, the person who finds the card would need to know his PIN to do any real damage. The smart card can also be programmed to store information in an encrypted fashion, as well as detect any tampering with the card itself. In the event that tampering is detected, the information stored on the smart card can be automatically wiped.
ch04.indd 192
10/5/2007 11:48:44 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
193 The drawbacks to using a smart card are the extra cost of the readers and the overhead of card generation, as with memory cards, although this cost is decreasing. The smart cards themselves are more expensive than memory cards because of the extra integrated circuits and microprocessor. Essentially, a smart card is a kind of computer, and because of that it has many of the operational challenges and risks that can affect a computer. Smart cards have several different capabilities, and as the technology develops and memory capacities increase for storage, they will gain even more. They can store personal information in a storage manner that is tamper resistant. This also allows them to have the ability to isolate security-critical computations within themselves. They can be used in encryption systems in order to store keys and have a high level of portability as well as security. The memory and integrated circuit also allow for the capacity to use encryption algorithms on the actual card and use them for secure authorization that can be utilized throughout an entire organization. Smart Card Attacks Smart cards are more tamperproof than memory cards, but where there is sensitive data there are individuals who are motivated to circumvent any countermeasure the industry throws at them. Over the years, people have become very inventive in the development of various ways to attack smart cards. For example, individuals have introduced computational errors into smart cards with the goal of uncovering the encryption keys used and stored on the cards. These “errors” are introduced by manipulating some environmental component of the card (changing input voltage, clock rate, temperature fluctuations). The attacker reviews the result of an encryption function after introducing an error to the card, and also reviews the correct result, which the card performs when no errors are introduced. Analysis of these different results may allow an attacker to reverse-engineer the encryption process, with the hope of uncovering the encryption key. This type of attack is referred to as fault generation. Side-channel attacks are nonintrusive and are used to uncover sensitive information about how a component works, without trying to compromise any type of flaw or weakness. As an analogy, suppose you want to figure out what your boss does each day at lunch time but you feel too uncomfortable to ask her. So you follow her, and you see she enters a building holding a small black bag and exits exactly 45 minutes later with the same bag and her hair not looking as great as when she went in. You keep doing this day after day and come to the conclusion that she must be working out. Now you could have simply read the sign on the building that said “Gym,” but we will give you the benefit of the doubt here and just not call you for any further private investigator work. So a noninvasive attack is one in which the attacker watches how something works and how it reacts in different situations instead of trying to “invade” it with more intrusive measures. Some examples of side-channel attacks that have been carried out on smart cards are differential power analysis (examining the power emissions released during processing), electromagnetic analysis (examining the frequencies emitted), and timing (how long a specific process takes to complete). These types of attacks are used to uncover sensitive information about how a component works without trying to compromise any type of flaw or weakness. They are commonly used for data collection.
ch04.indd 193
10/5/2007 11:48:44 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
194 Attackers monitor and capture the analog characteristics of all supply and interface connections and any other electromagnetic radiation produced by the processor during normal operation. They can also collect the time it takes for the smart card to carry out its function. From the collected data, the attacker can deduce specific information she is after, which could be a private key, sensitive financial data, or an encryption key stored on the card.
Interoperability An ISO/IEC standard, 14443, outlines the following items for smart card standardization: • ISO/IEC 14443-1 Physical characteristics • ISO/IEC 14443-3 Initialization and anticollision • ISO/IEC 14443-4 Transmission protocol
In the industry today, lack of interoperability is a big problem. Although vendors claim to be “compliant with ISO/IEC 14443,” many have developed technologies and methods in a more proprietary fashion. The lack of true standardization has caused some large problems because smart cards are being used for so many different applications. In the United States, the DoD is rolling out smart cards across all of their agencies, and NIST is developing a framework and conformance testing programs specifically for interoperability issues. Software attacks are also considered noninvasive attacks. A smart card has software just like any other device that does data processing, and anywhere there is software there is the possibility of software flaws that can be exploited. The main goal of this type of attack is to input instructions into the card that will allow the attacker to extract account information, which he can use to make fraudulent purchases. Many of these types of attacks can be disguised by using equipment that looks just like the legitimate reader. If you would like to be more intrusive in your smart card attack, give microprobing a try. Microprobing uses needles and ultrasonic vibration to remove the outer protective material on the card’s circuits. Once this is completed, data can be accessed and manipulated by directly tapping into the card’s ROM chips.
References • NIST Smart Card Standards and Research web page http://smartcard .nist.gov/ • Smart Card Alliance home page www.smartcardalliance.org • “Smart Cards: A Primer,” by Rinaldo Di Giorgio, JavaWorld (Dec. 1997) www.javaworld.com/javaworld/jw-12-1997/jw-12-javadev.html • “What Is a Smart Card?” HowStuffWorks.com http://electronics .howstuffworks.com/question332.htm
ch04.indd 194
10/5/2007 11:48:44 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
195 Authorization Now that I know who you are, let’s see if I will let you do what you want. Although authentication and authorization are quite different, together they comprise a two-step process that determines whether an individual is allowed to access a particular resource. In the first step, authentication, the individual must prove to the system that he is who he claims to be—a permitted system user. After successful authentication, the system must establish whether the user is authorized to access the particular resource and what actions he is permitted to perform on that resource. Authorization is a core component of every operating system, but applications, security add-on packages, and resources themselves can also provide this functionality. For example, suppose Marge has been authenticated through the authentication server and now wants to view a spreadsheet that resides on a file server. When she finds this spreadsheet and double-clicks the icon, she will see an hourglass instead of a mouse pointer. At this stage, the file server is seeing if Marge has the rights and permissions to view the requested spreadsheet. It also checks to see if Marge can modify, delete, move, or copy the file. Once the file server searches through an access matrix and finds that Marge does indeed have the necessary rights to view this file, the file opens up on Marge’s desktop. The decision of whether or not to allow Marge to see this file was based on access criteria. Access criteria are the crux of authentication.
Access Criteria You can perform that action only because we like you, and you wear a funny hat. We have gone over the basics of access control. This subject can get very granular in its level of detail when it comes to dictating what a subject can or cannot do to an object or resource. This is a good thing for network administrators and security professionals, because they want to have as much control as possible over the resources they have been put in charge of protecting, and a fine level of detail enables them to give individuals just the precise level of access they need. It would be frustrating if access control permissions were based only on full control or no access. These choices are very limiting, and an administrator would end up giving everyone full control, which would provide no protection. Instead, different ways of limiting access to resources exist, and if they are understood and used properly, they can give just the right level of access desired. Granting access rights to subjects should be based on the level of trust a company has in a subject and the subject’s need to know. Just because a company completely trusts Joyce with its files and resources does not mean she fulfills the need-to-know criteria to access the company’s tax returns and profit margins. If Maynard fulfills the need-to-know criteria to access employees’ work histories, it does not mean the company trusts him to access all of the company’s other files. These issues must be identified and integrated into the access criteria. The different access criteria can be enforced by roles, groups, location, time, and transaction types. Using roles is an efficient way to assign rights to a type of user who performs a certain task. This role is based on a job assignment or function. If there is a position within a company for a person to audit transactions and audit logs, the role this person fills would only need a read function to those types of files. This role would not need full control, modify, or delete privileges.
ch04.indd 195
10/5/2007 11:48:45 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
196 Using groups is another effective way of assigning access control rights. If several users require the same type of access to information and resources, putting them into a group and then assigning rights and permissions to that group is easier to manage than assigning rights and permissions to each and every individual separately. If a specific printer is available only to the accounting group, when a user attempts to print to it, the group membership of the user will be checked to see if she is indeed in the accounting group. This is one way that access control is enforced through a logical access control mechanism. Physical or logical location can also be used to restrict access to resources. Some files may be available only to users who can log on interactively to a computer. This means the user must be physically at the computer and enter the credentials locally versus logging on remotely from another computer. This restriction is implemented on several server configurations to restrict unauthorized individuals from being able to get in and reconfigure the server remotely. Logical location restrictions are usually done through network address restrictions. If a network administrator wants to ensure that status requests of an intrusion detection management console are accepted only from certain computers on the network, the network administrator can configure this within the software. Time of day, or temporal isolation, is another access control mechanism that can be used. If a security professional wants to ensure no one is accessing payroll files between the hours of 8:00 P.M. and 4:00 A.M., that configuration can be implemented to ensure access at these times is restricted. If the same security professional wants to ensure no bank account transactions happen during days on which the bank is not open, she can indicate in the logical access control mechanism this type of action is prohibited on Sundays. Temporal access can also be based on the creation date of a resource. Let’s say Russell started working for his company in March of 2007. There may be a business need to allow Russell to only access files that have been created after this date and not before. Transaction-type restrictions can be used to control what data is accessed during certain types of functions and what commands can be carried out on the data. An online banking program may allow a customer to view his account balance, but may not allow the customer to transfer money until he has a certain security level or access right. A bank teller may be able to cash checks of up to $2000, but would need a supervisor’s access code to retrieve more funds for a customer. A database administrator may be able to build a database for the human resources department, but may not be able to read certain confidential files within that database. These are all examples of transactiontype restrictions to control the access to data and resources.
Default to No Access If you’re unsure, just say no. Access control mechanisms should default to no access so as to provide the necessary level of security and ensure no security holes go unnoticed. A wide range of access levels is available to assign to individuals and groups, depending on the application and/or operating system. A user can have read, change, delete, full control, or no access permissions. The statement that security mechanisms should default to no access means that if nothing has been specifically configured for an individual or the group she belongs to, that user should not be able to access that resource. If access is not explicitly
ch04.indd 196
10/5/2007 11:48:45 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
197 Authorization Creep I think Mike’s a creep. Let’s not give him any authorization to access company stuff. Response: Sounds like a great criterion. All creeps—no access. As employees work at a company over time and move from one department to another, they often are assigned more and more access rights and permissions. This is commonly referred to as authorization creep. It can be a large risk for a company, because too many users have too much privileged access to company assets. In the past, it has usually been easier for network administrators to give more access than less, because then the user would not come back and require more work to be done on her profile. It is also difficult to know the exact access levels different individuals require. This is why user management and user provisioning are becoming more prevalent in identity management products today and why companies are moving more towards role-based access control implementation. Enforcing least privilege on user accounts should be an ongoing job, which means each user’s rights are permissions that should be reviewed to ensure the company is not putting itself at risk. Note: Rights and permission reviews have been incorporated into many regulatory induced processes. As part of the SOX regulations, managers have to review their employees’ permissions to data on an annual basis. allowed, it should be implicitly denied. Security is all about being safe, and this is the safest approach to practice when dealing with access control methods and mechanisms. In other words, all access controls should be based on the concept of starting with zero access, and building on top of that. Instead of giving access to everything, and then taking away privileges based on need to know, the better approach is to start with nothing and add privileges based on need to know. Most access control lists (ACLs) that work on routers and packet-filtering firewalls default to no access. Figure 4-9 shows that traffic from Subnet A is allowed to access Subnet B, traffic from Subnet D is not allowed to access Subnet A, and Subnet B is allowed to talk to Subnet A. All other traffic transmission paths not listed here are not allowed by default. Subnet D cannot talk to Subnet B because such access is not explicitly indicated in the router’s ACL.
Need to Know If you need to know, I will tell you. If you don’t need to know, leave me alone. The need-to-know principle is similar to the least-privilege principle. It is based on the concept that individuals should be given access only to the information they absolutely require in order to perform their job duties. Giving any more rights to a user just asks for headaches and the possibility of that user abusing the permissions assigned to him. An administrator wants to give a user the least amount of privileges she can, but just enough for that user to be productive when carrying out tasks. Management will decide what a user needs to know, or what access rights are necessary, and the administrator will configure the access control mechanisms to allow this user to have that level of access and no more, and thus the least privilege.
ch04.indd 197
10/5/2007 11:48:45 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
198
Figure 4-9 What is not explicitly allowed should be implicitly denied.
For example, if management has decided that Dan, the copy boy, needs to know where the files he needs to copy are located and needs to be able to print them, this fulfills Dan’s need-to-know criteria. Now, an administrator could give Dan full control of all the files he needs to copy, but that would not be practicing the least-privilege principle. The administrator should restrict Dan’s rights and permissions to only allow him to read and print the necessary files, and no more. Besides, if Dan accidentally deletes all the files on the whole file server, whom do you think management will hold ultimately responsible? Yep, the administrator. It is important to understand that it is management’s job to determine the security requirements of individuals and how access is authorized. The security administrator configures the security mechanisms to fulfill these requirements, but it is not her job to determine security requirements of users. Those should be left to the owners. If there is a security breach, management will ultimately be held responsible, so it should make these decisions in the first place.
Single Sign-On I only want to have to remember one username and one password for everything in the world! Many times employees need to access many different computers, servers, databases, and other resources in the course of a day to complete their tasks. This often requires
ch04.indd 198
10/5/2007 11:48:46 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
199 the employees to remember multiple user IDs and passwords for these different computers. In a utopia, a user would need to enter only one user ID and one password to be able to access all resources in all the networks this user is working in. In the real world, this is hard to accomplish for all system types. Because of the proliferation of client/server technologies, networks have migrated from centrally controlled networks to heterogeneous, distributed environments. The propagation of open systems and the increased diversity of applications, platforms, and operating systems have caused the end user to have to remember several user IDs and passwords just to be able to access and use the different resources within his own network. Although the different IDs and passwords are supposed to provide a greater level of security, they often end up compromising security (because users write them down) and causing more effort and overhead for the staff that manages and maintains the network. As any network staff member or administrator can attest to, too much time is devoted to resetting passwords for users who have forgotten them. More than one employee’s productivity is affected when forgotten passwords have to be reassigned. The network staff member who has to reset the password could be working on other tasks, and the user who forgot the password cannot complete his task until the network staff member is finished resetting the password. Many help-desk employees report that a majority of their time is spent on users forgetting their passwords. System administrators have to manage multiple user accounts on different platforms, which all need to be coordinated in a manner that maintains the integrity of the security policy. At times the complexity can be overwhelming, which results in poor access control management and the generation of many security vulnerabilities. A lot of time is spent on multiple passwords, and in the end they do not provide us with more security. The increased cost of managing a diverse environment, security concerns, and user habits, coupled with the users’ overwhelming desire to remember one set of credentials, has brought about the idea of single sign-on (SSO) capabilities. These capabilities would allow a user to enter credentials one time and be able to access all resources in primary and secondary network domains. This reduces the amount of time users spend authenticating to resources and enables the administrator to streamline user accounts and better control access rights. It improves security by reducing the probability that users will write down passwords and also reduces the administrator’s time spent on adding and removing user accounts and modifying access permissions. If an administrator needs to disable or suspend a specific account, she can do it uniformly instead of having to alter configurations on each and every platform. So that is our utopia: log on once and you are good to go. What bursts this bubble? Mainly interoperability issues. For SSO to actually work, every platform, application, and resource needs to accept the same type of credentials, in the same format, and interpret their meanings the same. When Steve logs on to his Windows XP workstation and gets authenticated by a mixed-mode Windows 2000 domain controller, it must authenticate him to the resources he needs to access on the Apple computer, the Unix server running NIS, the mainframe host server, the MICR print server, and the Windows XP computer in the secondary domain that has the plotter connected to it. A nice idea, until reality hits.
ch04.indd 199
10/5/2007 11:48:47 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
200
There is also a security issue to consider in an SSO environment. Once an individual is in, he is in. If an attacker was able to uncover one credential set, he would have There is also a security issue to consider in an SSO environment. Once an individual is in, he is in. If an attacker was able to uncover one credential set, he would have access to every resource within the environment that the compromised account has access to. This is certainly true, but one of the goals is that if a user only has to remember one password, and not ten, then a more robust password policy can be enforced. If the user has just one password to remember, then it can be more complicated and secure because he does not have nine other ones to remember also. SSO technologies come in different types. Each has its own advantages and disadvantages, shortcomings, and quality features. It is rare to see a real SSO environment; rather, you will see a cluster of computers and resources that accept the same credentials. Other resources, however, still require more work by the administrator or user side to access the systems. The SSO technologies that may be addressed in the CISSP exam are described in the next sections.
Kerberos Sam, there is a three-headed dog in front of the server! Kerberos is the name of a three-headed dog that guards the entrance to the underworld in Greek mythology. This is a great name for a security technology that provides authentication functionality, with the purpose of protecting a company’s assets. Kerberos is an authentication protocol and was designed in the mid-1980s as part of MIT’s Project Athena. It works in a client/server model and is based on symmetric key cryptography. The protocol has been used for years in Unix systems and is currently the default authentication method for Windows 2000 and 2003 operating systems. Com-
ch04.indd 200
10/5/2007 11:48:47 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
201 mercial products supporting Kerberos are becoming more frequent, so this one might be a keeper. Kerberos is an example of a single sign-on system for distributed environments, and is a de facto standard for heterogeneous networks. Kerberos incorporates a wide range of security capabilities, which gives companies much more flexibility and scalability when they need to provide an encompassing security architecture. It has four elements necessary for enterprise access control: scalability, transparency, reliability, and security. However, this open architecture also invites interoperability issues. When vendors have a lot of freedom to customize a protocol, it usually means no two vendors will customize it in the same fashion. This creates interoperability and incompatibility issues. Kerberos uses symmetric key cryptography and provides end-to-end security. Although it allows the use of passwords for authentication, it was designed specifically to eliminate the need to transmit passwords over the network. Most Kerberos implementations work with shared secret keys. Main Components in Kerberos The Key Distribution Center (KDC) is the most important component within a Kerberos environment. The KDC holds all users’ and services’ secret keys. It provides an authentication service, as well as key distribution functionality. The clients and services trust the integrity of the KDC, and this trust is the foundation of Kerberos security. The KDC provides security services to principals, which can be users, applications, or network services. The KDC must have an account for, and share a secret key with, each principal. For users, a password is transformed into a secret key value. The secret key is used to send sensitive data back and forth between the principal and the KDC, and is used for user authentication purposes. A ticket is generated by the ticket granting service (TGS) on the KDC and given to a principal when that principal, let’s say a user, needs to authenticate to another principal, let’s say a print server. The ticket enables one principal to authenticate to another principal. If Emily needs to use the print server, she must prove to the print server she is who she claims to be and that she is authorized to use the printing service. So Emily requests a ticket from the TGS. The TGS gives Emily the ticket, and in turn, Emily passes this ticket on to the print server. If the print server approves this ticket, Emily is allowed to use the print service. A KDC provides security services for a set of principals. This set is called a realm in Kerberos. The KDC is the trusted authentication server for all users, applications, and services within a realm. One KDC can be responsible for one realm or several realms. Realms are used to allow an administrator to logically group resources and users. So far, we know that principals (users and services) require the KDC’s services to authenticate to each other; that the KDC has a database filled with information about each and every principal within its realm; that the KDC holds and delivers cryptographic keys and tickets; and that tickets are used for principals to authenticate to each other. So how does this process work? The Kerberos Authentication Process The user and the KDC share a secret key, while the service and the KDC share a different secret key. The user and the re-
ch04.indd 201
10/5/2007 11:48:48 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
202 quested service do not share a symmetric key in the beginning. The user trusts the KDC because they share a secret key. They can encrypt and decrypt data they pass between each other, and thus have a protected communication path. Once the user authenticates to the service, they too will share a symmetric key (session key) that will enable them to encrypt and decrypt the information they need to pass to each other. This is how Kerberos provides data transmission protection. Here are the exact steps: 1. Emily comes in to work and enters her username and password into her workstation at 8 A.M. 2. The Kerberos software on Emily’s computer sends the username to the authentication service (AS) on the KDC, which in turn sends Emily a ticket granting ticket (TGT) that is encrypted with Emily’s password (secret key). 3. If Emily has entered her correct password, then this TGT is decrypted and Emily gains access to her local workstation desktop. 4. When Emily needs to send a print job to the print server, her system sends the TGT to the ticket granting service (TGS), which runs on the KDC. (This allows Emily to prove she has been authenticated and allows her to request access to the print server.) 5. The TGS creates and sends a second ticket to Emily, which she will use to authenticate to the print server. This second ticket contains two instances of the same session key, one encrypted with Emily’s secret key and the other encrypted with the print server’s secret key. The second ticket also contains an authenticator, which contains identification information on Emily, her system’s IP address, sequence number, and a timestamp. 6. Emily’s system receives the second ticket, decrypts and extracts the session key, adds a second authenticator set of identification information to the ticket, and sends the ticket onto the print server. 7. The print server receives the ticket, decrypts and extracts the session key, and decrypts and extracts the two authenticators in the ticket. If the printer server can decrypt and extract the session key, it knows the KDC created the ticket, because only the KDC has the secret key used to encrypt the session key. If the authenticator information that the KDC and the user put into the ticket matches, then the print server knows it received the ticket from the correct principal. 8. Once this is completed, it means Emily has been properly authenticated to the print server and the server prints her document. This is an extremely simplistic overview of what is going on in any Kerberos exchange, but it gives you an idea of the dance taking place behind the scenes whenever you interact with any network service in an environment that uses Kerberos. Figure 4-10 provides a simplistic view of this process.
ch04.indd 202
10/5/2007 11:48:48 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
203
Figure 4-10 The user must receive a ticket from the KDC before being able to use the requested resource.
The authentication service is the part of the KDC that authenticates a principal, and the TGS is the part of the KDC that makes the tickets and hands them out to the principals. TGTs are used so the user does not have to enter his password each time he needs to communicate with another principal. After the user enters his password, it is temporarily stored on his system, and any time the user needs to communicate with another principal, he just reuses the TGT. Be sure you understand that a session key is different from a secret key. A secret key is shared between the KDC and a principal and is static in nature. A session key is shared between two principals and is generated when needed and destroyed after the session is completed. If a Kerberos implementation is configured to use an authenticator, the user sends to the printer server her identification information and a timestamp and sequence number encrypted with the session key they share. The printer server decrypts this information and compares it with the identification data the KDC sent to it about this requesting user. If the data is the same, the printer server allows the user to send print jobs. The timestamp is used to help fight against replay attacks. The printer server compares the sent timestamp with its own internal time, which helps determine if the ticket has been sniffed and copied by an attacker, and then submitted at a later time in hopes of impersonating the legitimate user and gaining unauthorized access. The printer server checks the sequence number to make sure that this ticket has not been submitted previously. This is another countermeasure to protect against replay attacks. The primary reason to use Kerberos is that the principals do not trust each other enough to communicate directly. In our example, the print server will not print any-
ch04.indd 203
10/5/2007 11:48:49 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
204 one’s print job without that entity authenticating itself. So none of the principals trust each other directly; they only trust the KDC. The KDC creates tickets to vouch for the individual principals when they need to communicate. Suppose I need to communicate directly with you, but you do not trust me enough to listen and accept what I am saying. If I first give you a ticket from something you do trust (KDC), this basically says, “Look, the KDC says I am a trustworthy person. The KDC asked me to give this ticket to you to prove it.” Once that happens, then you will communicate directly with me. The same type of trust model is used in PKI environments. (More information on PKI is presented in Chapter 8.) In a PKI environment, users do not trust each other directly, but they all trust the certificate authority (CA). The CA vouches for the individuals’ identities by using digital certificates, the same as the KDC vouches for the individuals’ identities by using tickets. So why are we talking about Kerberos? Because it is one example of a single sign-on technology. The user enters a user ID and password one time and one time only. The tickets have time limits on them that administrators can configure. Many times, the lifetime of a TGT is eight to ten hours, so when the user comes in the next day, he will have to present his credentials again. NOTE Walking through these steps for the first time can be confusing.You can review a free animated overview of Kerberos at www.logicalsecurity.com/ kerberos. Weaknesses of Kerberos Kerberos:
The following are some of the potential weaknesses of
• The KDC can be a single point of failure. If the KDC goes down, no one can access needed resources. Redundancy is necessary for the KDC. • The KDC must be able to handle the number of requests it receives in a timely manner. It must be scalable. • Secret keys are temporarily stored on the users’ workstations, which means it is possible for an intruder to obtain these cryptographic keys. • Session keys are decrypted and reside on the users’ workstations, either in a cache or in a key table. Again, an intruder can capture these keys. • Kerberos is vulnerable to password guessing. The KDC does not know if a dictionary attack is taking place. • Network traffic is not protected by Kerberos if encryption is not enabled. • If the keys are too short, they can be vulnerable to brute force attacks. Kerberos must be transparent (work in the background without the user needing to understand it), scalable (work in large, heterogeneous environments), reliable (use distributed server architecture to ensure there is no single point of failure), and secure (provide authentication and confidentiality).
ch04.indd 204
10/5/2007 11:48:49 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
205 Kerberos and Password-Guessing Attacks Just because an environment uses Kerberos does not mean the systems are vulnerable to password-guessing attacks. The operating system itself will (should) provide the protection of tracking failed login attempts. The Kerberos protocol does not have this type of functionality, so another component must be in place to counter these types of attacks. No need to start ripping Kerberos out of your network environment after reading this section; your operating system provides the protection mechanism for this type of attack.
References • Kerberos FAQ
www.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html
• MIT Kerberos Papers and Documentation web page www.mit.edu/afs/ athena.mit.edu/astaff/project/kerberos/www/papers.html
SESAME The Secure European System for Applications in a Multi-vendor Environment (SESAME) project is a single sign-on technology developed to extend Kerberos functionality and improve upon its weaknesses. SESAME uses symmetric and asymmetric cryptographic techniques to authenticate subjects to network resources. NOTE Kerberos is a strictly symmetric key–based technology, whereas SESAME is based on both asymmetric and symmetric key cryptography.
Kerberos uses tickets to authenticate subjects to objects, whereas SESAME uses Privileged Attribute Certificates (PACs), which contain the subject’s identity, access capabilities for the object, access time period, and lifetime of the PAC. The PAC is digitally signed so the object can validate it came from the trusted authentication server, which is referred to as the Privileged Attribute Server (PAS). The PAS holds a similar role to that of the KDC within Kerberos. After a user successfully authenticates to the authentication service (AS), he is presented with a token to give to the PAS. The PAS then creates a PAC for the user to present to the resource he is trying to access. Figure 4-11 shows a basic overview of the SESAME process. NOTE Kerberos and SESAME can be accessed through the Generic Security Services Application Programming Interface (GSS-API), which is a generic API for client-to-server authentication. Using standard APIs enables vendors to communicate with and use each other’s functionality and security. Kerberos Version 5 and SESAME implementations allow any application to use their authentication functionality as long as the application knows how to communicate via GSS-API.
ch04.indd 205
10/5/2007 11:48:49 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
206
Figure 4-11 SESAME is very similar to Kerberos.
References • SESAME in a Nutshell www.cosic.esat.kuleuven.be/sesame/html/sesame_ what.html • SESAME links www.cosic.esat.kuleuven.ac.be/sesame/html/sesame_links.html
Security Domains I am highly trusted and have access to many resources. Response: So what. The term “domain” has been around a lot longer than Microsoft, but when people hear this term, they often think of a set of computers and devices on a network segment being controlled by a server that runs Microsoft software, referred to as a domain controller. A domain is really just a set of resources available to a subject. Remember that a subject can be a user, process, or application. Within an operating system, a process has a domain, which is the set of system resources available to the process to carry out its tasks. These resources can be memory segments, hard drive space, operating system services, and other processes. In a network environment, a domain is a set of physical and logical resources that is available, which can include routers, file servers, FTP service, web servers, and so forth. The term security domain just builds upon the definition of domain by adding the fact that resources within this logical structure (domain) are working under the same security
ch04.indd 206
10/5/2007 11:48:50 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
207 policy and managed by the same group. So, a network administrator may put all of the accounting personnel, computers, and network resources in Domain 1 and all of the management personnel, computers, and network resources in Domain 2. These items fall into these individual containers because they not only carry out similar types of business functions, but also, and more importantly, have the same type of trust level. It is this common trust level that allows entities to be managed by one single security policy. The different domains are separated by logical boundaries, such as firewalls with ACLs, directory services making access decisions, and objects that have their own ACLs indicating which individuals and groups can carry out operations on them. All of these security mechanisms are examples of components that enforce the security policy for each domain. Domains can be architected in a hierarchical manner that dictates the relationship between the different domains and the ways in which subjects within the different domains can communicate. Subjects can access resources in domains of equal or lower trust levels. Figure 4-12 shows an example of hierarchical network domains. Their communication channels are controlled by security agents (firewalls, router ACLs, directory services), and the individual domains are isolated by using specific subnet mask addresses.
Figure 4-12 Network domains are used to separate different network segments.
ch04.indd 207
10/5/2007 11:48:50 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
208 Remember that a domain does not necessarily pertain only to network devices and segmentations, but can also apply to users and processes. Figure 4-13 shows how users and processes can have more granular domains assigned to them individually based on their trust level. Group 1 has a high trust level and can access both a domain of its own trust level (Domain 1) and a domain of a lower trust level (Domain 2). User 1, who has a lower trust level, can access only the domain at his trust level and nothing higher. The system enforces these domains with access privileges and rights provided by the file system and operating system security kernel. So why are domains in the “Single Sign-On” section? Because several different types of technologies available today are used to define and enforce these domains and security policies mapped to them: domain controllers in a Windows environment, enterprise resource management (ERM) products, Microsoft Passport, and the various products that provide SSO functionality. The goal of each of them is to allow a user (subject) to sign in one time and be able to access the different domains available without having to reenter any other credentials.
Figure 4-13 Subjects can access specific domains based on their trust levels.
ch04.indd 208
10/5/2007 11:48:52 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
209 References • Underlining Technical Models for Information Technology Security, Recommendations of the National Institute of Standards and Technology, by Gary Stoneburner, NIST Special Publication 800-33 (Dec. 2001) http:// csrc.nist.gov/publications/nistpubs/800-33/sp800-33.pdf • “New Thinking About Information Technology Security,” by Marshall Abrams, PhD and Michael Joyce (first published in Computers & Security, Vol. 14, No. 1, pp. 57–68) www.acsac.org/secshelf/papers/new_thinking.pdf
Directory Services A network service is a mechanism that identifies resources (printers, file servers, domain controllers, and peripheral devices) on a network. A network directory service contains information about these different resources, and the subjects that need to access them, and carries out access control activities. If the directory service is working in a database based on the X.500 standard, it works in hierarchical schema that outlines the resources’ attributes, such as name, logical and physical location, subjects that can access them, and the operations that can be carried out on them. In a database based on the X.500 standard, access requests are made from users and other systems using the LDAP protocol. This type of database provides a hierarchical structure for the organization of objects (subjects and resources). The directory service develops unique distinguished names for each object and appends the corresponding attribute to each object as needed. The directory service enforces a security policy (configured by the administrator) to control how subjects and objects interact. Network directory services provide users access to network resources transparently, meaning that users don’t need to know the exact location of the resources or the steps required to access them. The network directory services handle these issues for the user in the background. Some examples of directory services are Lightweight Directory Access Protocol (LDAP), Novell NetWare Directory Service (NDS), and Microsoft Active Directory (AD). Note: Directory services were also covered in the “Identity Management” section, earlier in this chapter.
Thin Clients Hey, where’s my operating system? Response: You don’t deserve one. Diskless computers, sometimes thin clients, cannot store much information because of their lack of onboard storage space and necessary resources. This type of client/server technology forces users to log on to a central server just to use the computer and access network resources. When the user starts the computer, it runs a short list of instructions and then points itself to a server that will actually download the operating system, or interactive operating software, to the terminal. This enforces a strict type of access control, because the computer cannot do anything on its own until it authenticates to a centralized server, and then the server gives the computer its operating system, profile, and functionality. Thin-client technology provides another type of SSO access for users because users authenticate only to the central server or mainframe, which then provides them access to all authorized and necessary resources.
ch04.indd 209
10/5/2007 11:48:52 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
210 In addition to providing an SSO solution, a thin-client technology offers several other advantages. A company can save money by purchasing thin clients instead of powerful and expensive PCs. The central server handles all application execution, processing, and data storage. The thin client displays the graphical representation and sends mouse clicks and keystroke inputs to the central server. Having all of the software in one location, instead of distributed throughout the environment, allows for easier administration, centralized access control, easier updates, and standardized configurations. It is also easier to control malware infestations and the theft of confidential data because the thin clients often do not have CD-ROM, DVD, or USB ports. NOTE The technology industry came from a centralized model, with the use of mainframes and dumb terminals, and is in some ways moving back towards this model with the use of terminal services, Citrix, Service Oriented Architecture, and so on.
Examples of Single Sign-On Technologies • Kerberos Authentication protocol that uses a KDC and tickets, and is based on symmetric key cryptography • SESAME Authentication protocol that uses a PAS and PACs, and is based on symmetric and asymmetric cryptography • Security domains Resources working under the same security policy and managed by the same group • Thin clients Terminals that rely upon a central server for access control, processing, and storage
Access Control Models An access control model is a framework that dictates how subjects access objects. It uses access control technologies and security mechanisms to enforce the rules and objectives of the model. There are three main types of access control models: discretionary, mandatory, and nondiscretionary (also called role-based). Each model type uses different methods to control how subjects access objects, and each has its own merits and limitations. The business and security goals of an organization will help prescribe what access control model it should use, along with the culture of the company and the habits of conducting business. Some companies use one model exclusively, whereas others combine them to be able to provide the necessary level of protection. These models are built into the core or the kernel of the different operating systems and possibly their supporting applications. Every operating system has a security kernel that enforces a reference monitor concept, which differs depending upon the type of access control model embedded into the system. For every access attempt, before a subject can communicate with an object, the security kernel reviews the rules of the access control model to determine whether the request is allowed. The following sections explain these different models, their supporting technologies, and where they should be implemented.
ch04.indd 210
10/5/2007 11:48:52 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
211 Discretionary Access Control Only I can let you access my files. Response: Mother, may I? If a user creates a file, he is the owner of that file. An identifier for this user is placed in the file header. Ownership might also be granted to a specific individual. For example, a manager for a certain department might be made the owner of the files and resources within her department. A system that uses discretionary access control (DAC) enables the owner of the resource to specify which subjects can access specific resources. This model is called discretionary because the control of access is based on the discretion of the owner. Many times department managers, or business unit managers, are the owners of the data within their specific department. Being the owner, they can specify who should have access and who should not. In a DAC model, access is restricted based on the authorization granted to the users. This means users are allowed to specify what type of access can occur to the objects they own. If an organization is using a DAC model, the network administrator can allow resource owners to control who has access to their files. The most common implementation of DAC is through ACLs, which are dictated and set by the owners and enforced by the operating system. This can make a user’s ability to access information dynamic versus the more static role of mandatory access control (MAC). Most of the operating systems you may be used to dealing with are based on DAC models, such as all Windows, Linux, and Macintosh systems, and most flavors of Unix. When you look at the properties of a file or directory and see the choices that allow you to control which users can have access to this resource and to what degree, you are witnessing an instance of ACLs enforcing a DAC model. DACs can be applied to both the directory tree structure and the files it contains. The PC world has access permissions of No Access, Read (r), Write (w), Execute (x), Delete (d), Change (c), and Full Control. The Read attribute lets you read the file but not make changes. The Change attribute allows you to read, write, execute, and delete the file but does not let you change the ACLs or the owner of the files. Obviously, the attribute of Full Control lets you make any changes to the file and its permissions and ownership. It is through the discretionary model that Sam can share his D: drive with David so David can copy all of Sam’s MP3s. Sam can also block access to his D: drive from his manager so his manager does not know Sam is wasting valuable time and resources by downloading MP3s and sharing them with friends.
References • A Guide To Understanding Discretionary Access Control in Trusted Systems http://security.isu.edu/pdf/dac.pdf • Mandatory Versus Discretionary Access Control www.linuxplanet.com/ linuxplanet/tutorials/1527/2/ • Discretionary Access Control web.mit.edu/6.857/OldStuff/Fall96/lectures/ lecture24.ps.gz
ch04.indd 211
10/5/2007 11:48:53 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
212 Identity-Based Access Control DAC systems grant or deny access based on the identity of the subject. The identity can be a user identity or a group membership. So, for example, a data owner can choose to allow Bob (user identity) and the Accounting group (group membership identity) to access his file.
Mandatory Access Control In a mandatory access control (MAC) model, users and data owners do not have as much freedom to determine who can access files. The operating system makes the final decision and can override the users’ wishes. This model is much more structured and strict and is based on a security label system. Users are given a security clearance (secret, top secret, confidential, and so on), and data is classified in the same way. The clearance and classification data are stored in the security labels, which are bound to the specific subjects and objects. When the system makes a decision about fulfilling a request to access an object, it is based on the clearance of the subject, the classification of the object, and the security policy of the system. The rules for how subjects access objects are made by the security officer, configured by the administrator, enforced by the operating system, and supported by security technologies. Security labels are attached to all objects; thus, every file, directory, and device has its own security label with its classification information. A user may have a security clearance of secret, and the data he requests may have a security label with the classification of top secret. In this case, the user will be denied because his clearance is not equivalent or does not dominate (equal or higher than) the classification of the object. NOTE The terms “security labels” and “sensitivity labels” can be used interchangeably.
Each subject and object must have an associated label with attributes at all times, because this is part of the operating system’s access-decision criteria. Each subject and object does not require a physically unique label, but can be logically associated. For example, all subjects and objects on Server 1 can share the same label of secret clearance and classification. This type of model is used in environments where information classification and confidentiality is of utmost importance, such as a military institution. Special types of Unix systems are developed based on the MAC model. A company cannot simply choose to turn on either DAC or MAC. It has to purchase an operating system that has been specifically designed to enforce MAC rules. DAC systems do not understand security labels, classifications, or clearances, and thus cannot be used in institutions that require this type of structure for access control. The most recently released MAC system is SE Linux, developed by the NSA and Secure Computing. Trusted Solaris is a product based on the MAC model that most people are familiar with (relative to other MAC products).
ch04.indd 212
10/5/2007 11:48:53 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
213 References • Enterprise Security Policy http://cisr.nps.edu/cyberciege/ENCYLO/ Enterprise_Security_Policy.html • Mandatory Access Control http://en.wikipedia.org/wiki/Mandatory_access_ control • SELinux www.nsa.gov/selinux/
Sensitivity Labels I am very sensitive. Can I have a label? Response: Nope. When the MAC model is being used, every subject and object must have a sensitivity label, also called a security label. It contains a classification and different categories. The classification indicates the sensitivity level, and the categories enforce need-toknow rules. Figure 4-14 illustrates a sensitivity label. The classifications follow a hierarchical structure, one level being more trusted than another. However, the categories do not follow a hierarchical scheme, because they represent compartments of information within a system. The categories can correspond to departments (UN, Information Warfare, Treasury), projects (CRM, AirportSecurity, 2003Budget), or management levels. In a military environment, the classifications could be top secret, secret, confidential, and unclassified. Each classification is more trusted than the one below it. A commercial organization might use confidential, proprietary, corporate, and sensitive. The definition of the classification is up to the organization and should make sense for the environment in which it is used. The categories portion of the label enforces need-to-know rules. Just because someone has a top-secret clearance does not mean she now has access to all top-secret information. She must also have a need to know. As shown in Figure 4-14, if Cheryl has a top-secret clearance but does not have a need to know that is sufficient to access any of the listed categories (Dallas, Max, Cricket), she cannot look at this object. NOTE In MAC implementations, the system makes access decisions by comparing the subject’s clearance and need-to-know level to that of the security label. In DAC, the system compares the subject’s identity to the ACL on the resource. Software and hardware guards allow the exchange of data between trusted (high assurance) and less trusted (low assurance) systems and environments. For instance, if Figure 4-14 A sensitivity label is made up of a classification and categories.
ch04.indd 213
10/5/2007 11:48:53 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
214 you were working on a MAC system (working in dedicated security mode of secret) and you needed it to communicate to a MAC database (working in multilevel security mode, which goes up to top secret), the two systems would provide different levels of protection. If a system with lower assurance can directly communicate with a system of high assurance, then security vulnerabilities and compromises could be introduced. A software guard is really just a front-end product that allows interconnectivity between systems working at different security levels. Different types of guards can be used to carry out filtering, processing requests, data blocking, and data sanitization. A hardware guard can be implemented, which is a system with two NICs connecting the two systems that need to communicate with one another. Guards can be used to connect different MAC systems working in different security modes and they can be used to connect different networks working at different security levels. In many cases, the less trusted system can send messages to the more trusted system and can only receive acknowledgments back. This is common when e-mail messages need to go from less trusted systems to more trusted classified systems.
Role-Based Access Control I am in charge of chalk, thus I need full control of all servers! Response: Good try. A role-based access control (RBAC) model, also called nondiscretionary access control, uses a centrally administrated set of controls to determine how subjects and objects interact. This type of model lets access to resources be based on the role the user holds within the company. It is referred to as nondiscretionary because assigning a user to a role is unavoidably imposed. This means that if you are assigned only to the Contractor role in a company, there is nothing you can do about it. You don’t have the discretion to determine what role you will be assigned. The more traditional access control administration is based on just the DAC model, where access control is specified at the object level with ACLs. This approach is more complex because the administrator must translate an organizational authorization policy into permission when configuring ACLs. As the number of objects and users grows within an environment, users are bound to be granted unnecessary access to some objects, thus violating the least-privilege rule and increasing the risk to the company. The RBAC approach simplifies access control administration by allowing permissions to be managed in terms of user job roles. In an RBAC model, a role is defined in terms of the operations and tasks the role will carry out, whereas a DAC model outlines which subjects can access what objects. Let’s say we need a research and development analyst role. We develop this role not only to allow an individual to have access to all product and testing data, but also, and more importantly, to outline the tasks and operations that the role can carry out on this data. When the analyst role makes a request to access the new testing results on the file server, in the background the operating system reviews the role’s access levels before allowing this operation to take place.
ch04.indd 214
10/5/2007 11:48:54 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
215 NOTE Introducing roles also introduces the difference between rights being assigned explicitly and implicitly. If rights and permissions are assigned explicitly, it indicates they are assigned directly to a specific individual. If they are assigned implicitly, it indicates they are assigned to a role or group and the user inherits those attributes. An RBAC model is the best system for a company that has high employee turnover. If John, who is mapped to the contractor role, leaves the company, then Chrissy, his replacement, can be easily mapped to this role. That way, the administrator does not need to continually change the ACLs on the individual objects. He only needs to create a role (contractor), assign permissions to this role, and map the new user to this role. As discussed in the Identity Management section, organizations are moving more towards role-based access models to properly control identity and provisioning activities. The formal RBAC model has several approaches to security that can be used in software and organizations.
Core RBAC This component will be integrated in every RBAC implementation, because it is the foundation of the model. Users, roles, permissions, operations, and sessions are defined and mapped according to the security policy. • Has a many-to-many relationship among individual users and privileges • Session is a mapping between a user and a subset of assigned roles • Accommodates traditional but robust group-based access control Many users can belong to many groups with various privileges outlined for each group. When the user logs in (this is a session), the various roles and groups this user has been assigned will be available to the user at one time. If I am a member of the Accounting role, RD group, and Administrative role, when I log on, all of the permissions assigned to these various groups are available to me. This model provides robust options because it can include other components when making access decisions, instead of just basing the decision on a credential set. The RBAC system can be configured to also include time of day, location of role, day of the week, and so on. This means other information, not just the user ID and credential, is used for access decisions.
Hierarchical RBAC This component allows the administrator to set up an organizational RBAC model that maps to the organizational structures and functional delineations required in a specific environment. This is very useful since businesses are already set up in a personnel hierarchical structure. In most cases, the higher you are in the chain of command, the more access you will most likely have.
ch04.indd 215
10/5/2007 11:48:54 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
216 1. Role relation defining user membership and privilege inheritance. For example, the nurse role can access a certain amount of files and the lab technician role can access another set of files. The doctor role inherits the permissions and access rights of these two roles and has more elevated rights already assigned to the doctor role. So hierarchical is an accumulation of rights and permissions of other roles. 2. Reflects organizational structures and functional delineations 3. Two types of hierarchies: a. Limited hierarchies—Only one level of hierarchy is allowed (Role 1 inherits from Role 2 and no other role) b. General hierarchies—Allows for many levels of hierarchies (Role 1 inherits Role 2 and Role 3’s permissions) Hierarchies are a natural means of structuring roles to reflect an organization’s lines of authority and responsibility. Role hierarchies define an inheritance relation among roles. Different separations of duties are provided under this model. • Static Separation of Duty (SSD) Relations through RBAC This would be used to deter fraud by constraining the combination of privileges (such as, the user cannot be a member of both the Cashier and Accounts Receivable groups). • Dynamic Separation of Duties (DSD) Relations through RBAC This would be used to deter fraud by constraining the combination of privileges that can be activated in any session (for instance, the user cannot be in both the Cashier and Cashier Supervisor roles at the same time, but the user can be a member of both).This one is a little more confusing. It means Joe is a member of both the Cashier and Cashier Supervisor. If he logs in as a Cashier, the Supervisor role is unavailable to him during that session. If he logs in as Cashier Supervisor, the Cashier role is unavailable to him during that session. Role-based access control can be managed in the following ways: • Non-RBAC
Users are mapped directly to applications and no roles are used.
• Limited RBAC Users are mapped to multiple roles and mapped directly to other types of applications that do not have role-based access functionality. • Hybrid RBAC Users are mapped to multi-application roles with only selected rights assigned to those roles. • Full RBAC Users are mapped to enterprise roles.
References • Role-Based Access Control http://hissa.nist.gov/project/rbac.html • Role-Based Access Control Case Studies http://csrc.nist.gov/rbac • Role-Based Access Control on the Web www.list.gmu.edu/journals/tissec/ p37-park.pdf
ch04.indd 216
10/5/2007 11:48:54 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
217 • “A Role-Based Access Control Model and Reference Implementation Within a Corporate Intranet,” by John Barkley, D. Richard Kuhn, and David Ferraiolo (first published in ACM Transactions on Information and System Security, Vol. 2, No. 1, Feb. 1999, pp. 34–64) www.ecs.syr.edu/faculty/chin/ cse774/readings/rbac/p34-ferraiolo.pdf
RBAC, MAC, DAC A lot of confusion exists regarding whether RBAC is a type of DAC model or a type of MAC model. Different sources claim different things, but in fact it is a model in its own right. In the 1960s and 1970s, the U.S. military and NSA did a lot of research on the MAC model. DAC, which also sprang to life in the ‘60s and ‘70s, has its roots in the academic and commercial research laboratories. The RBAC model, which started gaining popularity in the 1990s, can be used in combination with MAC and DAC systems. For the most up-to-date information on the RBAC model, go to http://csrc.nist.gov/rbac, which has documents that describe an RBAC standard and independent model, with the goal of clearing up this continual confusion.
Access Control Techniques and Technologies Once an organization determines what type of access control model it is going to use, it needs to identify and refine its technologies and techniques to support that model. The following sections describe the different access controls and technologies available to support different access control models.
Rule-Based Access Control Everyone will adhere to my rules. Response: Who are you again? Rule-based access control uses specific rules that indicate what can and cannot happen between a subject and an object. It is based on the simple concept of “if X then Y” programming rules, which can be used to provide finer-grained access control to resources. Before a subject can access an object in a certain circumstance, it must meet a
Access Control Models The main characteristics of the three different access control models are important to understand. • DAC Data owners decide who has access to resources, and ACLs are used to enforce the security policy. • MAC Operating systems enforce the system’s security policy through the use of security labels. • RBAC Access decisions are based on each subject’s role and/or functional position.
ch04.indd 217
10/5/2007 11:48:55 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
218 set of predefined rules. This can be simple and straightforward, as in “if the user’s ID matches the unique user ID value in the provided digital certificate, then the user can gain access.” Or there could be a set of complex rules that must be met before a subject can access an object. For example, “If the user is accessing the system between Monday and Friday and between 8 A.M. and 5 P.M., and if the user’s security clearance equals or dominates the object’s classification, and if the user has the necessary need to know, then the user can access the object.” Rule-based access control is not necessarily identity-based. The DAC model is identity-based. For example, an identity-based control would stipulate that Tom Jones can read File1 and modify File2. So when Tom attempts to access one of these files, the operating system will check his identity and compare it to the values within an ACL to see if Tom can carry out the operations he is attempting. In contrast, here is a rule-based example: a company may have a policy that dictates that e-mail attachments can only be 5MB or smaller. This rule affects all users. If rule-based was identity-based, it would mean that Sue can accept attachments of 10MB and smaller, Bob can accept attachments 2MB and smaller, and Don can only accept attachments 1MB and smaller. This would be a mess and too confusing. Rule-based access controls simplify this by setting a rule that will affect all users across the board—no matter what their identity is. Rule-based access allows a developer to define specific and detailed situations in which a subject can or cannot access an object, and what that subject can do once access is granted. Traditionally, rule-based access control has been used in MAC systems as an enforcement mechanism of the complex rules of access that MAC systems provide. Today, rule-based access is used in other types of systems and applications as well. Content filtering uses If-Then programming languages, which is a way to compare data or an activity to a long list of rules. For example, “If an e-mail message contains the word ‘Viagra’, then disregard. If an e-mail message contains the words ‘sex’ and ‘free,’ then disregard,” and so on. Many routers and firewalls use rules to determine which types of packets are allowed into a network and which are rejected. Rule-based access control is a type of compulsory control, because the administrator sets the rules and the users cannot modify these controls.
References • “Creating a Policy-Aware Web: Discretionary, Rule-based Access for the World Wide Web,” Tim Berners-Lee, et al. www.w3.org/2004/09/PolicyAware-Web-acl.pdf • Rule-Based Access Control for Web Services www-128.ibm.com/ developerworks/webservices/library/ws-soa-access.html • Access Control http://foundation.bricksfactory.org/deliverables/d353/ ar01s06.html
Constrained User Interfaces Constrained user interfaces restrict users’ access abilities by not allowing them to request certain functions or information, or to have access to specific system resources. Three major types of restricted interfaces exist: menus and shells, database views, and physically constrained interfaces.
ch04.indd 218
10/5/2007 11:48:55 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
219 When menu and shell restrictions are used, the options users are given are the commands they can execute. For example, if an administrator wants users to be able to execute only one program, that program would be the only choice available on the menu. This limits the users’ functionality. A shell is a type of virtual environment within a system. It is the user’s interface to the operating system and works as a command interpreter. If restricted shells were used, the shell would contain only the commands the administrator wants the users to be able to execute. Many times, a database administrator will configure a database so users cannot see fields that require a level of confidentiality. Database views are mechanisms used to restrict user access to data contained in databases. If the database administrator wants managers to be able to view their employees’ work records but not their salary information, then the salary fields would not be available to these types of users. Similarly, when payroll employees look at the same database, they will be able to view the salary information but not the work history information. This example is illustrated in Figure 4-15. Physically constraining a user interface can be implemented by providing only certain keys on a keypad or certain touch buttons on a screen. You see this when you get money from an ATM machine. This device has a type of operating system that can accept all kinds of commands and configuration changes, but you are physically constrained from being able to carry out these functions. You are presented with buttons that only enable you to withdrawal, view your balance, or deposit funds. Period.
Access Control Matrix The matrix—let’s see, should I take the red pill or the blue pill? An access control matrix is a table of subjects and objects indicating what actions individual subjects can take upon individual objects. Matrices are data structures that programmers implement as table lookups that will be used and enforced by the operating system. Table 4-1 provides an example of an access control matrix. This type of access control is usually an attribute of DAC models. The access rights can be assigned directly to the subjects (capabilities) or to the objects (ACLs).
Figure 4-15 Different database views of the same tables
ch04.indd 219
10/5/2007 11:48:55 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
220 User
File1
File2
File3
Diane
Read and execute
Read, write, and execute
No access
Katie
Read and execute
Read
No access
Chrissy
Read, write, and execute
Read and execute
Read
John
Read and execute
No access
Read and write
Table 4-1 An Example of an Access Control Matrix
Capability Tables A capability table specifies the access rights a certain subject possesses pertaining to specific objects. A capability table is different from an ACL because the subject is bound to the capability table, whereas the object is bound to the ACL. The capability corresponds to the subject’s row in the access control matrix. In Table 4-1, Diane’s capabilities are File1: read and execute; File2: read, write, and execute; File3: no access. This outlines what Diane is capable of doing to each resource. An example of a capability-based system is Kerberos. In this environment, the user is given a ticket, which is his capability table. This ticket is bound to the user and dictates what objects that user can access and to what extent. The access control is based on this ticket, or capability table. Figure 4-16 shows the difference between a capability table and an ACL. A capability can be in the form of a token, ticket, or key. When a subject presents a capability component, the operating system (or application) will review the access rights and operations outlined in the capability component and allows the subject to carry out just those functions. A capability component is a data structure that contains a unique object identifier and the access rights the subject has to that object. The object may be a file, array, memory segment, or port. Each user, process, and application in a capability system has a list of capabilities.
Access Control Lists Access control lists (ACLs) are used in several operating systems, applications, and router configurations. They are lists of subjects that are authorized to access a specific ob-
Figure 4-16 A capability table is bound to a subject, whereas an ACL is bound to an object.
ch04.indd 220
10/5/2007 11:48:55 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
221 ject, and they define what level of authorization is granted. Authorization can be specified to an individual or group. ACLs map values from the access control matrix to the object. Whereas a capability corresponds to a row in the access control matrix, the ACL corresponds to a column of the matrix. The ACL for File1 in Table 4-1 is shown in Table 4-2.
Content-Dependent Access Control This is sensitive information, so only Bob and I can look at it. Response: Well, since Bob is your imaginary friend, I think I can live by that rule. As the name suggests, with content-dependent access control, access to objects is determined by the content within the object. The earlier example pertaining to database views showed how content-dependent access control can work. The content of the database fields dictates which users can see specific information within the database tables. Content-dependent filtering is used when corporations employ e-mail filters that look for specific strings, such as “confidential,” “social security number,” “top secret,” and any other types of words the company deems suspicious. Corporations also have this in place to control web surfing—where filtering is done to look for specific words— to try to figure out whether employees are gambling or looking at pornography.
Context-Dependent Access Control First you kissed a parrot, then you threw your shoe, and then you did a jig. That’s the right sequence, you are allowed access. Context-dependent access control differs from content-dependent access control in that it makes access decisions based on the context of a collection of information rather than on the sensitivity of the data. A system that is using context-dependent access control “reviews the situation” and then makes a decision. For example, firewalls make context-based access decisions when they collect state information on a packet before allowing it into the network. A stateful firewall understands the necessary steps of communication for specific protocols. For example, in a TCP connection, the sender sends an SYN packet, the receiver sends an SYN/ACK, and then the sender acknowledges that packet with an ACK packet. A stateful firewall understands these different steps and will not allow packets to go through that do not follow this sequence. So, if a stateful firewall receives a SYN/ACK and there was not a previous SYN packet that correlates with
Table 4-2 The ACL for File1
ch04.indd 221
User
File1
Diane
Read and execute
Katie
Read and execute
Chrissy
Read, write, and execute
John
Read and execute
10/5/2007 11:48:56 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
222 this connection, the firewall understands this is not right and disregards the packet. This is what stateful means—something that understands the necessary steps of a dialog session. And this is an example of context-dependent access control, where the firewall understands the context of what is going on and includes that as part of its access decision.
Access Control Administration Once an organization develops a security policy, supporting procedures, standards, and guidelines (described in Chapter 3), it must choose the type of access control model: DAC, MAC, or role-based. After choosing a model, the organization must select and implement different access control technologies and techniques. Access control matrices, restricted interfaces, and content-dependent, context-dependent, and rule-based controls are just a few of the choices. If the environment does not require a high level of security, the organization will choose discretionary and/or role-based. The DAC model enables data owners to allow other users to access their resources, so an organization should choose the DAC model only if it is fully aware of what it entails. If an organization has a high turnover rate and/ or requires a more centralized access control method, the role-based model is more appropriate. If the environment requires a higher security level and only the administrator should be able to grant access to resources, then a MAC model is the best choice. What is left to work out is how the organization will administer the access control model. Access control administration comes in two basic flavors: centralized and decentralized. The decision makers should understand both approaches so they choose and implement the proper one to achieve the level of protection required.
Access Control Techniques Access control techniques are used to support the access control models. • Access control matrix Table of subjects and objects that outlines their access relationships • ACL
Bound to an object and indicates what subjects can access it
• Capability table Bound to a subject and indicates what objects that subject can access • Content-based access Bases access decisions on the sensitivity of the data, not solely on subject identity • Context-based access Bases access decisions on the state of the situation, not solely on identity or content sensitivity • Restricted interface Limits the user’s environment within the system, thus limiting access to objects • Rule-based access Restricts subjects’ access attempts by predefined rules
ch04.indd 222
10/5/2007 11:48:56 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
223 Centralized Access Control Administration I control who can touch the carrots and who can touch the peas. Response: Could you leave now? A centralized access control administration method is basically what it sounds like: one entity (department or individual) is responsible for overseeing access to all corporate resources. This entity (security administrator) configures the mechanisms that enforce access control, processes any changes that are needed to a user’s access control profile, disables access when necessary, and completely removes these rights when a user is terminated, leaves the company, or moves to a different position. This type of administration provides a consistent and uniform method of controlling users’ access rights. It supplies strict control over data because only one entity (department or individual) has the necessary rights to change access control profiles and permissions. Although this provides for a more consistent and reliable environment, it can be a slow one, because all changes must be processed by one entity. The following sections present some examples of centralized remote access control technologies. Each of these authentication protocols is referred to as an AAA protocol, which stands for authentication, authorization, and auditing. (Some resources have the last A stand for accounting, but it is the same functionality—just a different name.) Depending upon the protocol, there are different ways to authenticate a user in this client/server architecture. The traditional authentication protocols are Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and a newer method referred to as Extensible Authentication Protocol (EAP). Each of these authentication protocols is discussed at length in Chapter 7.
RADIUS So, I have to run across half of a circle to be authenticated? Response: Don’t know. Give it a try. Remote Authentication Dial-In User Service (RADIUS) is a client/server authentication protocol that authenticates and authorizes remote users. A network may have access servers, a modem pool, DSL, ISDN, or T1 line dedicated for remote users to communicate through. The access server requests the remote user’s logon credentials and passes them back to a RADIUS server, which houses the usernames and password values. The remote user is a client to the access server, and the access server is a client to the RADIUS server. Most ISPs today use RADIUS to authenticate customers before they are allowed access to the Internet. The access server and customer’s software negotiate, through a handshake procedure, and agree upon an authentication protocol (PAP, CHAP, or EAP). The customer provides to the access server a username and password. This communication takes place over a PPP connection. The access server and RADIUS server communicate over the RADIUS protocol. Once the authentication is completed properly, the customer’s system is given an IP address and connection parameters, and is allowed access to the Internet. The access server notifies the RADIUS server when the session starts and stops, for billing purposes.
ch04.indd 223
10/5/2007 11:48:57 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
224 RADIUS is also used within corporate environments to provide road warriors and home users access to network resources. RADIUS allows companies to maintain user profiles in a central database. When a user dials in and is properly authenticated, a preconfigured profile is assigned to him to control what resources he can and cannot access. This technology allows companies to have a single administered entry point, which provides standardization in security and a simplistic way to track usage and network statistics. RADIUS was developed by Livingston Enterprises for its network access server product series, but was then published as RFC 2138 and RFC 2139. This means it is an open protocol that any vendor can use and manipulate so it will work within its individual products. Because RADIUS is an open protocol, it can be used in different types of implementations. The format of configurations and user credentials can be held in LDAP servers, various databases, or text files. Figure 4-17 shows some examples of possible RADIUS implementations.
TACAS Terminal Access Controller Access Control System (TACACS) has a very funny name. Not funny ha-ha, but funny “huh?” TACACS has been through three generations: TACACS, Extended TACACS (XTACACS), and TACACS+. TACACS combines its authentication
Figure 4-17 Environments can implement different RADIUS infrastructures.
ch04.indd 224
10/5/2007 11:48:57 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
225 and authorization processes, XTACACS separates authentication, authorization, and auditing processes, and TACACS+ is XTACACS with extended two-factor user authentication. TACACS uses fixed passwords for authentication, while TACACS+ allows users to employ dynamic (one-time) passwords, which provides more protection. NOTE TACACS+ is really not a new generation of TACACS and XTACACS; it is a brand new protocol that provides similar functionality and shares the same naming scheme. Because it is a totally different protocol, it is not backward-compatible with TACACS or XTACACS. TACACS+ provides basically the same functionality as RADIUS with a few differences in some of its characteristics. First, TACACS+ uses TCP as its transport protocol, while RADIUS uses UDP. “So what?” you may be thinking. Well, any software that is developed to use UDP as its transport protocol has to be “fatter” with intelligent code that will look out for the items that UDP will not catch. Since UDP is a connectionless protocol, it will not detect or correct transmission errors. So RADIUS must have the necessary code to detect packet corruption, long timeouts, or dropped packets. Since the developers of TACACS+ choose to use TCP, the TACACS+ software does not have to have the extra code to look for and deal with these transmission problems. TCP is a connection-oriented protocol, and that is its job and responsibility. RADIUS encrypts the user’s password only as it is being transmitted from the RADIUS client to the RADIUS server. Other information, as in the username, accounting, and authorized services, is passed in cleartext. This is an open invitation for attackers to capture session information for replay attacks. Vendors who integrate RADIUS into their products need to understand these weaknesses and integrate other security mechanisms to protect against these types of attacks. TACACS+ encrypts all of this data between the client and server and thus does not have the vulnerabilities inherent in the RADIUS protocol. The RADIUS protocol combines the authentication and authorization functionality. TACACS+ uses a true AAA architecture, which separates the authentication, authorization, and accounting functionalities. This gives a network administrator more flexibility in how remote users are authenticated. For example, if Tom is a network administrator and has been assigned the task of setting up remote access for users, he must decide between RADIUS and TACACS+. If the current environment already authenticates all of the local users through a domain controller using Kerberos, then Tom can configure the remote users to be authenticated in this same manner, as shown in Figure 4-18. Instead of having to maintain a remote access server database of remote user credentials and a database within Active Directory for local users, Tom can just configure and maintain one database. The separation of authentication, authorization, and accounting functionality provides this capability. TACACS+ also enables the network administrator to define more granular user profiles, which can control the actual commands users can carry out. Remember that RADIUS and TACACS+ are both protocols, and protocols are just agreed-upon ways of communication. When a RADIUS client communicates with a RADIUS server, it does so through the RADIUS protocol, which is really just a set of defined fields that will accept certain values. These fields are referred to as attributevalue pairs (AVPs). As an analogy, suppose I send you a piece of paper that has several different boxes drawn on it. Each box has a headline associated with it: first name, last
ch04.indd 225
10/5/2007 11:48:57 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
226
Figure 4-18 TACACS+ works in a client/server model.
name, hair color, shoe size. You fill in these boxes with your values and send it back to me. This is basically how protocols work; the sending system just fills in the boxes (fields) with the necessary information for the receiving system to extract and process. Since TACACS+ allows for more granular control on what users can and cannot do, TACACS+ has more AVPs, which allows the network administrator to define ACLs, filters, user privileges, and much more. Table 4-3 points out the differences between RADIUS and TACACS+. So, RADIUS is the appropriate protocol when simplistic username/password authentication can take place and users only need an Accept or Deny for obtaining access, as in ISPs. TACACS+ is the better choice for environments that require more sophisticated authentication steps and tighter control over more complex authorization activities, as in corporate networks.
ch04.indd 226
10/5/2007 11:48:58 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
227 RADIUS
TACACS+
Packet delivery
UDP
TCP
Packet encryption
Encrypts only the password from the RADIUS client to the server.
Encrypts all traffic between the client and server.
AAA support
Combines authentication and authorization services.
Uses the AAA architecture, separating authentication, authorization, and auditing.
Multiprotocol support
Works over PPP connections.
Supports other protocols, such as AppleTalk, NetBIOS, and IPX.
Responses
Uses single-challenge response when authenticating a user, which is used for all AAA activities.
Uses multiple-challenge response for each of the AAA processes. Each AAA activity must be authenticated.
Table 4-3 Specific Differences Between These Two AAA Protocols
Watchdog Watchdog timers are commonly used to detect software faults, such as a process ending abnormally or hanging. The watchdog functionality sends out a type of “heartbeat” packet to determine whether a service is responding. If it is not, the process can be terminated or reset. This guards against software deadlocks, infinite loops, and process prioritization problems. This functionality can be used in AAA protocols to determine whether packets need to be re-sent and whether connections experiencing problems should be closed and reopened.
Diameter If we create our own technology, we get to name it any goofy thing we want! Response: I like Snizzernoodle. Diameter is a protocol that has been developed to build upon the functionality of RADIUS and overcome many of its limitations. The creators of this protocol decided to call it Diameter as a play on the term RADIUS—as in the diameter is twice the radius. Diameter is another AAA protocol that provides the same type of functionality as RADIUS and TACACS+ but also provides more flexibility and capabilities to meet the new demands of today’s complex and diverse networks. At one time, all remote communication took place over PPP and SLIP connections and users authenticated themselves through PAP or CHAP. Those were simpler, happier times when our parents had to walk uphill both ways to school wearing no shoes. As with life, technology has become much more complicated and there are more devices and protocols to choose from than ever before. Today, we want our wireless devices and smart phones to be able to authenticate themselves to our networks and we use roaming protocols, Mobile IP, Ethernet over PPP, Voice over IP (VoIP), and other crazy stuff that the traditional AAA protocols cannot keep up with. So in came the smart people with a new AAA protocol, Diameter, that can deal with these issues and many more.
ch04.indd 227
10/5/2007 11:48:59 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
228 Diameter protocol consists of two portions. The first is the base protocol, which provides the secure communication among Diameter entities, feature discovery, and version negotiation. The second is the extensions, which are built on top of the base protocol to allow various technologies to use Diameter for authentication.
Mobile IP This technology allows a user to move from one network to another and still use the same IP address. It is an improvement upon the IP protocol because it allows a user to have a home IP address, associated with his home network, and a care-of address. The care-of address changes as he moves from one network to the other. All traffic that is addressed to his home IP address is forwarded to his care-of address. Up until the conception of Diameter, IETF has had individual working groups who defined how Voice over IP (VoIP), Fax over IP (FoIP), Mobile IP, and remote authentication protocols work. Defining and implementing them individually in any network can easily result in too much confusion and interoperability. It requires customers to roll out and configure several different policy servers and increases the cost with each new added service. Diameter provides a base protocol, which defines header formats, security options, commands, and AVPs. This base protocol allows for extensions to tie in other services, such as VoIP, FoIP, Mobile IP, wireless, and cell phone authentication. So Diameter can be used as an AAA protocol for all of these different uses. As an analogy, consider a scenario in which ten people all need to get to the same hospital, which is where they all work. They all have different jobs (doctor, lab technician, nurse, janitor, and so on), but they all need to end up at the same location. So, they can either all take their own cars and their own routes to the hospital, which takes up more hospital parking space and requires the gate guard to authenticate each and every car, or they can take a bus. The bus is the common element (base protocol) to get the individuals (different services) to the same location (networked environment). Diameter provides the common AAA and security framework that different services can work within, as illustrated in Figure 4-19. NOTE Roaming Operations (ROAMOPS) allows PPP users to gain access to the Internet without the need of dialing into their home service provider. The individual service providers, who have roaming agreements, carry out crossauthentication for their customers so users can dial into any service provider’s point of presence and gain Internet access. RADIUS and TACACS+ are client/server protocols, which means the server portion cannot send unsolicited commands to the client portion. The server portion can only speak when spoken to. Diameter is a peer-based protocol that allows either end to initiate communication. This functionality allows the Diameter server to send a message to the access server to request the user to provide another authentication credential if she is attempting to access a secure resource.
ch04.indd 228
10/5/2007 11:48:59 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
229
Figure 4-19 Diameter provides an AAA architecture for several services.
Diameter is backward-compatible with RADIUS, uses UDP and AVPs, and provides proxy server support. It has better error detection and correction functionality than RADIUS, as well as better fail-over properties, and thus provides better network resilience. Diameter also provides end-to-end security through the use of IPSec or TLS, which is not available in RADIUS. Diameter has the functionality and ability to provide the AAA functionality for other protocols and services because it has a large AVP set. RADIUS has 28 (256) AVPs, while Diameter has 232 (a whole bunch). Recall from earlier in the chapter that AVPs are like boxes drawn on a piece of paper that outline how two entities can communicate back and forth. So, more AVPs allow for more functionality and services to exist and communicate between systems. Diameter provides the following AAA functionality: • Authentication • PAP, CHAP, EAP • End-to-end protection of authentication information • Replay attack protection • Authorization • Redirects, secure proxies, relays, and brokers • State reconciliation • Unsolicited disconnect • Reauthorization on demand • Accounting • Reporting, ROAMOPS accounting, event monitoring You may not be familiar with Diameter, because it is relatively new. It probably won’t be taking over the world tomorrow, but it will be used by environments that need to provide the type of services being demanded of them, and then slowly seep down into corporate networks as more products are available. RADIUS has been around for a long time and has served its purpose well, so don’t expect it to exit the stage any time soon.
ch04.indd 229
10/5/2007 11:49:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
230 References • RFC 3588 – Diameter Base Protocol www.faqs.org/rfcs/rfc3588.html • RFC 2869 – RADIUS Extensions www.faqs.org/rfcs/rfc2869.html • RFC 2865 – Remote Authentication Dial In User Service (RADIUS) www.faqs.org/rfcs/rfc2865.html • RFC 2975 – Introduction to Accounting Management rfc2975.html
www.faqs.org/rfcs/
Decentralized Access Control Administration Okay, everyone just do whatever you want. A decentralized access control administration method gives control of access to the people closer to the resources—the people who may better understand who should and should not have access to certain files, data, and resources. In this approach, it is often the functional manager who assigns access control rights to employees. An organization may choose to use a decentralized model if its managers have better judgment regarding which users should be able to access different resources, and there is no business requirement that dictates strict control through a centralized body is necessary. Changes can happen faster through this type of administration because not just one entity is making changes for the whole organization. However, there is a possibility that conflicts of interest could arise that may not benefit the organization. Because no single entity controls access as a whole, different managers and departments can practice security and access control in different ways. This does not provide uniformity and fairness across the organization. One manager could be too busy with daily tasks and decide it is easier to let everyone have full control over all the systems in the department. Another department may practice a stricter and detail-oriented method of control by giving employees only the level of permissions needed to fulfill their tasks. Also, certain controls can overlap, in which case actions may not be properly proscribed or restricted. If Mike is part of the accounting group and recently has been under suspicion for altering personnel account information, the accounting manager may restrict his access to these files to read-only access. However, the accounting manager does not realize that Mike still has full-control access under the network group he is also a member of. This type of administration does not provide methods for consistent control, as a centralized method would. Another issue that comes up with decentralized administration is lack of proper consistency pertaining to the company’s protection. For example, when Sean is fired for looking at pornography on his computer, some of the groups Sean is a member of may not disable his account. So, Sean may still have access after he is terminated, which could cause the company heartache if Sean is vindictive.
Access Control Methods Access controls can be implemented at various layers of a network and individual systems. Some controls are core components of operating systems or embedded into applications and devices, and some security controls require third-party add-on packages. Although different controls provide different functionality, they should all work to-
ch04.indd 230
10/5/2007 11:49:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
231 gether to keep the bad guys out and the good guys in, and to provide the necessary quality of protection. Most companies do not want people to be able to walk into their building arbitrarily, sit down at an employee’s computer, and access network resources. Companies also don’t want every employee to be able to access all information within the company, as in human resource records, payroll information, and trade secrets. Companies want some assurance that employees who can access confidential information will have some restrictions put upon them, making sure, say, a disgruntled employee does not have the ability to delete financial statements, tax information, and top-secret data that would put the company at risk. Several types of access controls prevent these things from happening, as discussed in the sections that follow.
Access Control Layers Access control consists of three broad categories: administrative, technical, and physical. Each category has different access control mechanisms that can be carried out manually or automatically. All of these access control mechanisms should work in concert with each other to protect an infrastructure and its data. Each category of access control has several components that fall within it, as shown next: • Administrative Controls • Policy and procedures • Personnel controls • Supervisory structure • Security-awareness training • Testing • Physical Controls • Network segregation • Perimeter security • Computer controls • Work area separation • Data backups • Cabling • Control zone • Technical Controls • System access • Network architecture • Network access • Encryption and protocols • Auditing
ch04.indd 231
10/5/2007 11:49:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
232 The following sections explain each of these categories and components and how it relates to access control.
Administrative Controls Senior management must decide what role security will play in the organization, including the security goals and objectives. These directives will dictate how all the supporting mechanisms will fall into place. Basically, senior management provides the skeleton of a security infrastructure and then appoints the proper entities to fill in the rest. The first piece to building a security foundation within an organization is a security policy. It is management’s responsibility to construct a security policy and delegate the development of the supporting procedures, standards, and guidelines, indicate which personnel controls should be used, and specify how testing should be carried out to ensure all pieces fulfill the company’s security goals. These items are administrative controls and work at the top layer of a hierarchical access control model. (Administrative controls are examined in detail in Chapter 3, but are mentioned here briefly to show the relationship to logical and physical controls pertaining to access control.)
Personnel Controls Personnel controls indicate how employees are expected to interact with security mechanisms and address noncompliance issues pertaining to these expectations. These controls indicate what security actions should be taken when an employee is hired, terminated, suspended, moved into another department, or promoted. Specific procedures must be developed for each situation, and many times the human resources and legal departments are involved with making these decisions.
Supervisory Structure Management must construct a supervisory structure in which each employee has a superior to report to, and that superior is responsible for that employee’s actions. This forces management members to be responsible for employees and take a vested interest in their activities. If an employee is caught hacking into a server that holds customer credit card information, that employee and her supervisor will face the consequences. This is an administrative control that aids in fighting fraud and enforcing proper control.
Security-Awareness Training How do you know they know what they are supposed to know? In many organizations, management has a hard time spending money and allocating resources for items that do not seem to affect the bottom line: profitability. This is why training traditionally has been given low priority, but as computer security becomes more and more of an issue to companies, they are starting to recognize the value of security-awareness training. A company’s security depends upon technology and people, and people are usually the weakest link and cause the most security breaches and compromises. If users understand how to properly access resources, why access controls are in place, and the ramifications for not using the access controls properly, a company can reduce many types of security incidents.
ch04.indd 232
10/5/2007 11:49:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
233 Testing All security controls, mechanisms, and procedures must be tested on a periodic basis to ensure they properly support the security policy, goals, and objectives set for them. This testing can be a drill to test reactions to a physical attack or disruption of the network, a penetration test of the firewalls and perimeter network to uncover vulnerabilities, a query to employees to gauge their knowledge, or a review of the procedures and standards to make sure they still align with implemented business or technology changes. Because change is constant and environments continually evolve, security procedures and practices should be continually tested to ensure they align with management’s expectations and stay up-to-date with each addition to the infrastructure. It is management’s responsibility to make sure these tests take place.
Physical Controls We will go much further into physical security in Chapter 6, but it is important to understand certain physical controls must support and work with administrative and technical (logical) controls to supply the right degree of access control. Examples of physical controls include having a security guard verify individuals’ identities prior to entering a facility, erecting fences around the exterior of the facility, making sure server rooms and wiring closets are locked and protected from environmental elements (humidity, heat, and cold), and allowing only certain individuals to access work areas that contain confidential information. Some physical controls are introduced next, but again, these and more physical mechanisms are explored in depth in Chapter 6.
Network Segregation I have used my Lego set to outline the physical boundaries between you and me. Response: Can you make the walls a little higher please? Network segregation can be carried out through physical and logical means. A network might be physically designed to have all AS400 computers and databases in a certain area. This area may have doors with security swipe cards that allow only individuals who have a specific clearance to access this section and these computers. Another section of the network may contain web servers, routers, and switches, and yet another network portion may have employee workstations. Each area would have the necessary physical controls to ensure that only the permitted individuals have access into and out of those sections.
Perimeter Security How perimeter security is implemented depends upon the company and the security requirements of that environment. One environment may require employees to be authorized by a security guard by showing a security badge that contains a picture identification before being allowed to enter a section. Another environment may require no authentication process and let anyone and everyone into different sections. Perimeter security can also encompass closed-circuit TVs that scan the parking lots and waiting areas, fences surrounding a building, the lighting of walkways and parking areas, motion detectors, sensors, alarms, and the location and visual appearance of a building. These are examples of perimeter security mechanisms that provide physical access control by providing protection for individuals, facilities, and the components within facilities.
ch04.indd 233
10/5/2007 11:49:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
234 Computer Controls Each computer can have physical controls installed and configured, such as locks on the cover so the internal parts cannot be stolen, the removal of the floppy and CD-ROM drives to prevent copying of confidential information, or implementation of a protection device that reduces the electrical emissions to thwart attempts to gather information through airwaves.
Work Area Separation Some environments might dictate that only particular individuals can access certain areas of the facility. For example, research companies might not want office personnel to be able to enter laboratories so they can’t disrupt experiments or access test data. Most network administrators allow only network staff in the server rooms and wiring closets, to reduce the possibilities of errors or sabotage attempts. In financial institutions, only certain employees can enter the vaults or other restricted areas. These examples of work area separation are physical controls used to support access control and the overall security policy of the company.
Cabling Different types of cabling can be used to carry information throughout a network. Some cable types have sheaths that protect the data from being affected by the electrical interference of other devices that emit electrical signals. Some types of cable have protection material around each individual wire to ensure there is no crosstalk between the different wires. All cables need to be routed throughout the facility so they not in the way of employees or are exposed to any dangers like being cut, burnt, crimped, or eavesdropped upon.
Control Zone The company facility should be split up into zones depending up on the sensitivity of the activity that takes place per zone. The front lobby could be considered a public area, the product development area could be considered top secret, and the executive offices could be considered secret. It does not matter what classifications are used, but it should be understood that some areas are more sensitive than others, which will require different access control based on the needed protection level. The same is true of the company network. It should be segmented, and access controls should be chosen for each zone based on the criticality of devices and the sensitivity of data being processed.
Technical Controls Technical controls are the software tools used to restrict subjects’ access to objects. They are core components of operating systems, add-on security packages, applications, network hardware devices, protocols, encryption mechanisms, and access control matrixes. These controls work at different layers within a network or system and need to maintain a synergistic relationship to ensure there is no unauthorized access to resources and that the resources’ availability, integrity, and confidentiality are guaranteed. Technical controls protect the integrity and availability of resources by limiting the number of
ch04.indd 234
10/5/2007 11:49:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
235 subjects that can access them and protecting the confidentiality of resources by preventing disclosure to unauthorized subjects. The following sections explain how some technical controls work and where they are implemented within an environment.
System Access Different types of controls and security mechanisms control how a computer is accessed. If an organization is using a MAC architecture, the clearance of a user is identified and compared to the resource’s classification level to verify that this user can access the requested object. If an organization is using a DAC architecture, the operating system checks to see if a user has been granted permission to access this resource. The sensitivity of data, clearance level of users, and users’ rights and permissions are used as logical controls to control access to a resource. Many types of technical controls enable a user to access a system and the resources within that system. A technical control may be a username and password combination, a Kerberos implementation, biometrics, public key infrastructure (PKI), RADIUS, TACACS, or authentication using a smart card through a reader connected to a system. These technologies verify the user is who he says he is by using different types of authentication methods. Once a user is properly authenticated, he can be authorized and allowed access to network resources. These technologies are addressed in further detail in future chapters, but for now understand that system access is a type of technical control that can enforce access control objectives.
Network Architecture The architecture of a network can be constructed and enforced through several logical controls to provide segregation and protection of an environment. Whereas a network can be segregated physically by walls and location, it can also be segregated logically through IP address ranges and subnets and by controlling the communication flow between the segments. Often, it is important to control how one segment of a network communicates with another segment. Figure 4-20 is an example of how an organization may segregate its network and determine how network segments can communicate. This example shows that the organization does not want the internal network and the demilitarized zone (DMZ) to have open and unrestricted communication paths. There is usually no reason for internal users to have direct access to the systems in the DMZ, and cutting off this type of communication reduces the possibilities of internal attacks on those systems. Also, if an attack comes from the Internet and successfully compromises a system on the DMZ, the attacker must not be able to easily access the internal network, which this type of logical segregation protects against. This example also shows how the management segment can communicate with all other network segments, but those segments cannot communicate in return. The segmentation is implemented because the management consoles that control the firewalls and IDSs reside in the management segment, and there is no reason for users, other than the administrator, to have access to these computers. A network can be segregated physically and logically. This type of segregation and restriction is accomplished through logical controls.
ch04.indd 235
10/5/2007 11:49:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
236
Figure 4-20 Technical network segmentation controls how different network segments communicate.
Network Access Systems have logical controls that dictate who can and cannot access them and what those individuals can do once they are authenticated. This is also true for networks. Routers, switches, firewalls, and bridges all work as technical controls to enforce access
ch04.indd 236
10/5/2007 11:49:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
237 restriction into and out of a network, and access to the different segments within the network. If an attacker from the Internet wants to gain access to a specific computer, chances are she will have to hack through a firewall, router, and a switch just to be able to start an attack on a specific computer that resides within the internal network. Each device has its own logical controls that make decisions about what entities can access them and what type of actions they can carry out. Access to different network segments should be granular in nature. Routers and firewalls can be used to ensure that only certain types of traffic get through to each segment.
Encryption and Protocols Encryption and protocols work as technical controls to protect information as it passes throughout a network and resides on computers. They ensure that the information is received by the correct entity, and that it is not modified during transmission. These logical controls can preserve the confidentiality and integrity of data and enforce specific paths for communication to take place. (Chapter 8 is dedicated to cryptography and encryption mechanisms.)
Auditing Auditing tools are technical controls that track activity within a network, on a network device, or on a specific computer. Even though auditing is not an activity that will deny an entity access to a network or computer, it will track activities so a network administrator can understand the types of access that took place, identify a security breach, or warn the administrator of suspicious activity. This information can be used to point out weaknesses of other technical controls and help the administrator understand where changes must be made to preserve the necessary security level within the environment. NOTE Many of the subjects touched on in these sections will be fully addressed and explained in later chapters.What is important to understand is that there are administrative, technical, and physical controls that work toward providing access control, and you should know several examples of each for the exam.
Access Control Types As previously stated, access control types (administrative, physical, and technical) work at different levels, but different levels of what? They work together at different levels within their own categories. A security guard is a type of control used to scare off attackers and ensure that only authorized personnel enter a building. If an intruder gets around the security guard in some manner, he could be faced with motion detectors, locks on doors, and alarms. These layers are depicted in Figure 4-21. Each control works at a different level of granularity, but it can also perform different functionalities. The different functionalities of access controls are preventive, detective, corrective, deterrent, recovery, compensating, and directive.
ch04.indd 237
10/5/2007 11:49:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
238 Figure 4-21 Security should be implemented in layers, which provides several barriers to attackers.
By having a better understanding of the different control functionalities, you will be able to make more informed decisions about what controls will be best used in specific kinds of situations. The seven different access control functionalities are as follows: • Deterrent Intended to discourage a potential attacker • Preventive Intended to avoid an incident from occurring • Corrective Fixes components or systems after an incident has occurred • Recovery
Intended to bring controls back to regular operations
• Detective Helps identify an incident’s activities • Compensating Controls that provide for an alternative measure of control • Directive Mandatory controls that have been put in place due to regulations or environmental requirements Once you understand fully what the different controls do, you can use them in the right locations for specific risks—or you can just put them where they would look the prettiest. When looking at a security structure of an environment, it is most productive to use a preventive model and then use detective, recovery, and corrective mechanisms to help
ch04.indd 238
10/5/2007 11:49:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
239 support this model. Basically, you want to stop any trouble before it starts, but you must be able to quickly react and combat trouble if it does find you. All security controls should be built on the concept of preventive security. However, it is not feasible to prevent everything; therefore, what you cannot prevent, you should be able to quickly detect. That’s why preventive and detective controls should always be implemented together and should complement each other. To take this concept further, what you can’t prevent, you should be able to detect, and if you detect something, it means you weren’t able to prevent it, and therefore you should take corrective action to make sure it is indeed prevented the next time around. Therefore, all three types work together: preventive, detective, and corrective. The control types described next (administrative, physical, and technical) are preventive in nature. These are important to understand when developing a security access control model and when taking the CISSP exam.
Preventive: Administrative The following are soft mechanisms put into place to enforce access control and protect the company as a whole: • Policies and procedures • Effective hiring practices • Pre-employment background checks • Controlled termination processes • Data classification and labeling • Security awareness NOTE One best practice that can be incorporated would require individuals to sign a statement outlining what expectations are regarding the access they are being granted. This in turn can be used for either termination of the individual from the work environment, and possibly prosecution under the governing laws such as the Computer Fraud and Abuse Act. The improper administration and management of access controls is the main cause for most unauthorized access compromises.
Preventive: Physical The following can physically restrict access to a facility, specific work areas, or computer systems: • Badges, swipe cards • Guards, dogs • Fences, locks, mantraps
ch04.indd 239
10/5/2007 11:49:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
240 Preventive: Technical The following are logical controls that are part of operating systems, third-party application add-ons, or hardware units: • Passwords, biometrics, smart cards • Encryption, protocols, call-back systems, database views, constrained user interfaces • Antivirus software, ACLs, firewalls, routers, clipping levels Table 4-4 shows how these categories of access control mechanisms perform different security functions. However, Table 4-4 does not necessarily cover all the possibilities. For example, a fence can provide preventive and deterrent measures by making it harder for intruders to access a facility, but it could also be a compensative control. If a company cannot afford a security guard, it might erect a fence to act as the compensative physical control. Each control is able to meet more requirements than what is listed in the table. Table 4-4 is only an example to show the relationship among the different controls and the security attributes they could provide. NOTE Locks are usually considered delay mechanisms because they only delay a determined intruder. The goal is to delay access long enough to allow law enforcement or the security guard to respond to the situation. Any control can really end up being a compensating control. An organization would choose a compensating control if another control is too expensive but protection is still needed. For example, a company can’t afford a security guard staff, so they erect fences, which would be the compensating control. Another reason to use a compensating control is business needs. If the security team recommends closing a specific port on a firewall, but the business requires that service to be available to external users, then the compensating control could be to implement an intrusion prevention system (IPS) that would closely monitor the traffic coming in from that port. Several types of security mechanisms exist, and they all need to work together. The complexity of the controls and of the environment they are in can cause the controls to contradict each other or leave gaps in security. This can introduce unforeseen holes in the company’s protection not fully understood by the implementers. A company may have very strict technical access controls in place and all the necessary administrative controls up to snuff, but if any person is allowed to physically access any system in the facility, then clear security dangers are present within the environment. Together, these controls should work in harmony to provide a healthy, safe, and productive environment.
ch04.indd 240
10/5/2007 11:49:03 AM
ch04.indd 241
X X
Biometric system
Mantrap doors
X X
Table 4-4 Services That Security Controls Provide
Job rotation
Separation of duties
Monitoring and supervising
Security policy
Administrative X
X
Closed-circuit TVs
Offsite facility
X
Motion detectors
X
X
Security guard
Lighting
X
Badge system
Identify undesirable events that have occurred
Avoid undesirable events from occurring
X
Detective
Preventive
Locks
Fences
Physical
Category of Control:
Type of Control:
Correct undesirable events that have occurred
Corrective
X
X
Discourage security violations
Deterrent
X
Restore resources and capabilities
Recovery
X
X
X
X
X
X
X
X
X
X
X
X
X
X
Provide alternatives to other controls
Compensative
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
241
10/5/2007 11:49:03 AM
ch04.indd 242
X X
Information classification
Personnel procedures
X
Security-awareness training
X
Dial-up call-back systems
Table 4-4 Services That Security Controls Provide (continued)
Data backup
X
Smart cards
Server images
X
X
Antivirus software
IDS
X
Encryption X
X
Routers
X
Detective
Audit logs
X
ACLs
Technical
X
Testing
Investigations
Preventive
Type of Control:
X
X
Corrective
Deterrent
X
Recovery
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
Compensative
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
242
10/5/2007 11:49:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
243
Accountability Auditing capabilities ensure users are accountable for their actions, verify that the security policies are enforced, and can be used as investigation tools. There are several reasons why network administrators and security professionals want to make sure accountability mechanisms are in place and configured properly: to be able to track bad deeds back to individuals, detect intrusions, reconstruct events and system conditions, provide legal recourse material, and produce problem reports. Audit documentation and log files hold a mountain of information—the trick is usually deciphering it and presenting it in a useful and understandable format. Accountability is tracked by recording user, system, and application activities. This recording is done through auditing functions and mechanisms within an operating system or application. Audit trails contain information about operating system activities, application events, and user actions. Audit trails can be used to verify the health of a system by checking performance information or certain types of errors and conditions. After a system crashes, a network administrator often will review audit logs to try and piece together the status of the system and attempt to understand what events could be attributed to the disruption. Audit trails can also be used to provide alerts about any suspicious activities that can be investigated at a later time. In addition, they can be valuable in determining exactly how far an attack has gone and the extent of the damage that may have been caused. It is important to make sure a proper chain of custody is maintained to ensure any data collected can later be properly and accurately represented in case it needs to be used for later events such as criminal proceedings or investigations. It is a good idea to keep the following in mind when dealing with auditing: • Store the audits securely. • The right audit tools will keep the size of the logs under control. • The logs must be protected from any unauthorized changes in order to safeguard data. • Train the right people to review the data in the right manner. • Make sure the ability to delete logs is only available to administrators. • Logs should contain activities of all high-privileged accounts (root, administrator). An administrator configures what actions and events are to be audited and logged. In a high-security environment, the administrator would configure more activities to be captured and set the threshold of those activities to be more sensitive. The events can be reviewed to identify where breaches of security occurred and if the security policy had been violated. If the environment does not require such levels of security, the events analyzed would be fewer, with less demanding thresholds. Items and actions to be audited can become an endless list. A security professional should be able to assess an environment and its security goals, know what actions should be audited, and know what is to be done with that information after it
ch04.indd 243
10/5/2007 11:49:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
244 is captured—without wasting too much disk space, CPU power, and staff time. The following gives a broad overview of the items and actions that can be audited and logged: • System-level events • System performance • Logon attempts (successful and unsuccessful) • Logon ID • Date and time of each logon attempt • Lockouts of users and terminals • Use of administration utilities • Devices used • Functions performed • Requests to alter configuration files • Application-level events • Error messages • Files opened and closed • Modifications of files • Security violations within application • User-level events • Identification and authentication attempts • Files, services, and resources used • Commands initiated • Security violations The threshold (clipping level) and parameters for each of these items must be configured. For example, an administrator can audit each logon attempt or just each failed logon attempt. System performance can look only at the amount of memory used within an eight-hour period, or the memory, CPU, and hard drive space used within an hour. Intrusion detection systems (IDSs) continually scan audit logs for suspicious activity. If an intrusion or harmful event takes place, audit logs are usually kept to be used later to prove guilt and prosecute if necessary. If severe security events take place, many times the IDS will alert the administrator or staff member so they can take proper actions to end the destructive activity. If a dangerous virus is identified, administrators may take the mail server offline. If an attacker is accessing confidential information within the database, this computer may be temporarily disconnected from the network or Internet. If an attack is in progress, the administrator may want to watch the actions taking place so she can track down the intruder. IDSs can watch for this type of activity during real time and/or scan audit logs and watch for specific patterns or behaviors.
ch04.indd 244
10/5/2007 11:49:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
245 Review of Audit Information It does no good to collect it if you don’t look at it. Audit trails can be reviewed manually or through automated means—either way, they must be reviewed and interpreted. If an organization reviews audit trails manually, it needs to establish a system of how, when, and why they are viewed. Usually audit logs are very popular items right after a security breach, unexplained system action, or system disruption. An administrator or staff member rapidly tries to piece together the activities that led up to the event. This type of audit review is event-oriented. Audit trails can also be viewed periodically to watch for unusual behavior of users or systems, and to help understand the baseline and health of a system. Then there is a real-time, or near real-time, audit analysis that can use an automated tool to review audit information as it is created. Administrators should have a scheduled task of reviewing audit data. The audit material usually needs to be parsed and saved to another location for a certain time period. This retention information should be stated in the company’s security policy and procedures. Reviewing audit information manually can be overwhelming. There are applications and audit trail analysis tools that reduce the volume of audit logs to review and improve the efficiency of manual review procedures. A majority of the time, audit logs contain information that is unnecessary, so these tools parse out specific events and present them in a useful format. An audit-reduction tool does just what its name suggests—reduces the amount of information within an audit log. This tool discards mundane task information and records system performance, security, and user functionality information that can be useful to a security professional or administrator.
Keystroke Monitoring Oh, you typed an L. Let me write that down. Oh, and a P, and a T, and an S…hey, slow down! Keystroke monitoring is a type of monitoring that can review and record keystrokes entered by a user during an active session. The person using this type of monitoring can have the characters written to an audit log to be reviewed at a later time. This type of auditing is usually done only for special cases and only for a specific amount of time, because the amount of information captured can be overwhelming and/or unimportant. If a security professional or administrator is suspicious of an individual and his activities, she may invoke this type of monitoring. In some authorized investigative stages, a keyboard dongle may be unobtrusively inserted between the keyboard and the computer to capture all the keystrokes entered, including power-on passwords. A hacker can also use this type of monitoring. If an attacker can successfully install a Trojan horse on a computer, the Trojan horse can install an application that captures data as it is typed into the keyboard. Typically, these programs are most interested in user credentials and can alert the attacker when credentials have been successfully captured. Privacy issues are involved with this type of monitoring, and administrators could be subject to criminal and civil liabilities if it is done without proper notification to the employees and authorization from management. If a company wants to use this type
ch04.indd 245
10/5/2007 11:49:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
246 of auditing, it should state so in the security policy, address the issue in security-awareness training, and present a banner notice to the user warning that the activities at that computer may be monitored in this fashion. These steps should be taken to protect the company from violating an individual’s privacy, and they should inform the users where their privacy boundaries start and stop pertaining to computer use.
Protecting Audit Data and Log Information If an intruder breaks into your house, he will do his best to cover his tracks by not leaving fingerprints or any other clues that can be used to tie him to the criminal activity. The same is true in computer fraud and illegal activity. The intruder will work to cover his tracks. Attackers often delete audit logs that hold this incriminating information. (Deleting specific incriminating data within audit logs is called scrubbing.) Deleting this information can cause the administrator to not be alerted or aware of the security breach, and can destroy valuable data. Therefore, audit logs should be protected by strict access control. Only certain individuals (the administrator and security personnel) should be able to view, modify, and delete audit trail information. No other individuals should be able to view this data, much less modify or delete it. The integrity of the data can be ensured with the use of digital signatures, message digest tools, and strong access controls. Its confidentiality can be protected with encryption and access controls, if necessary, and it can be stored on write-once media (CD-ROMs) to prevent loss or modification of the data. Unauthorized access attempts to audit logs should be captured and reported. Audit logs may be used in a trial to prove an individual’s guilt, demonstrate how an attack was carried out, or corroborate a story. The integrity and confidentiality of these logs will be under scrutiny. Proper steps need to be taken to ensure that the confidentiality and integrity of the audit information is not compromised in any way.
References • Authentication, Authorization, and Accounting (AAA) Charter www.ietf .org/html.charters/HISTORY/aaa-charter.2006-08-01.15.html • Google authentication categories http://directory.google.com/Top/ Computers/Security/Authentication • Security in Open Systems, NIST Special Publication 800-7 (July 1994) http://ftp4.de.freesbie.org/pub/misc/cert.dfn/csir/nist/nistpubs/ 800-7/main.html
Access Control Practices The fewest number of doors open allows the fewest number of flies in. We have gone over how users are identified, authenticated, and authorized, and how their actions are audited. These are necessary parts of a healthy and safe network environment. You also want to take steps to ensure there are no unnecessary open doors and that the environment stays at the same security level you have worked so
ch04.indd 246
10/5/2007 11:49:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
247 hard to achieve. This means you need to implement good access control practices. Not keeping up with daily or monthly tasks usually causes the most vulnerabilities in an environment. It is hard to put out all the network fires, fight the political battles, fulfill all the users’ needs, and still keep up with small maintenance tasks. However, many companies have found that not doing these small tasks caused them the greatest heartache of all. The following is a list of tasks that must be done on a regular basis to ensure security stays at a satisfactory level: • Deny access to systems by undefined users or anonymous accounts. • Limit and monitor the usage of administrator and other powerful accounts. • Suspend or delay access capability after a specific number of unsuccessful logon attempts. • Remove obsolete user accounts as soon as the user leaves the company. • Suspend inactive accounts after 30 to 60 days. • Enforce strict access criteria. • Enforce the need-to-know and least-privilege practices. • Disable unneeded system features, services, and ports. • Replace default password settings on accounts. • Limit and monitor global access rules. • Ensure logon IDs are not descriptive of job function. • Remove redundant resource rules from accounts and group memberships. • Remove redundant user IDs, accounts, and role-based accounts from resource access lists. • Enforce password rotation. • Enforce password requirements (length, contents, lifetime, distribution, storage, and transmission). • Audit system and user events and actions and review reports periodically. • Protect audit logs. Even if all of these countermeasures are in place and properly monitored, data can still be lost in an unauthorized manner in other ways. The next section looks at these issues and their corresponding countermeasures.
Unauthorized Disclosure of Information Several things can make information available to others for whom it is not intended, which can bring about unfavorable results. Sometimes this is done intentionally; other times, unintentionally. Information can be disclosed unintentionally when one falls prey to attacks that specialize in causing this disclosure. These attacks include social
ch04.indd 247
10/5/2007 11:49:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
248 engineering, covert channels, malicious code, and electrical airwave sniffing. Information can be disclosed accidentally through object reuse methods, which are explained next. (Social engineering was discussed in Chapter 3, while covert channels will be discussed in Chapter 5.)
Object Reuse Can I borrow this floppy? Response: Let me destroy it first. Object reuse issues pertain to reassigning to a subject media that previously contained one or more objects. Huh? This means before someone uses a hard drive, USB drive, or tape, it should be cleared of any residual information still on it. This concept also applies to objects reused by computer processes, such as memory locations, variables, and registers. Any sensitive information that may be left by a process should be securely cleared before allowing another process the opportunity to access the object. This ensures that information not intended for this individual or any other subject is not disclosed. Many times, USB drives are exchanged casually in a work environment. What if a supervisor lent a USB drive to an employee without erasing it and it contained confidential employee performance reports and salary raises forecasted for the next year? This could prove to be a bad decision and may turn into a morale issue if the information was passed around. Formatting a disk or deleting files only removes the pointers to the files; it does not remove the actual files. This information will still be on the disk and available until the operating system needs that space and overwrites those files. So, for media that holds confidential information, more extreme methods should be taken to ensure the files are actually gone, not just their pointers. Sensitive data should be classified (secret, top secret, confidential, unclassified, and so on) by the data owners. How the data are stored and accessed should also be strictly controlled and audited by software controls. However, it does not end there. Before allowing someone to use previously used media, it should be erased or degaussed. (This responsibility usually falls on the operations department.) If media holds sensitive information and cannot be purged, steps should be created describing how to properly destroy it so no one else can obtain this information. NOTE Sometimes hackers actually configure a sector on a hard drive so it is marked as bad and unusable to an operating system, but that is actually fine and may hold malicious data. The operating system will not write information to this sector because it thinks it is corrupted. This is a form of data hiding. Some boot-sector virus routines are capable of putting the main part of their code (payload) into a specific sector of the hard drive, overwriting any data that may have been there, and then protecting it as a bad block.
Emanation Security Quick, cover your computer and your head in tinfoil! All electronic devices emit electrical signals. These signals can hold important information, and if an attacker buys the right equipment and positions himself in the right place, he could capture this information from the airwaves and access data transmissions as if he had a tap directly on the network wire.
ch04.indd 248
10/5/2007 11:49:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
249 Several incidents have occurred in which intruders have purchased inexpensive equipment and used it to intercept electrical emissions as they radiated from a computer. This equipment can reproduce data streams and display the data on the intruder’s monitor, enabling the intruder to learn of covert operations, find out military strategies, and uncover and exploit confidential information. This is not just stuff found in spy novels. It really happens. So, the proper countermeasures have been devised. Tempest Tempest started out as a study carried out by the DoD and then turned into a standard that outlines how to develop countermeasures that control spurious electrical signals emitted by electrical equipment. Special shielding is used on equipment to suppress the signals as they are radiated from devices. Tempest equipment is implemented to prevent intruders from picking up information through the airwaves with listening devices. This type of equipment must meet specific standards to be rated as providing Tempest shielding protection. Tempest refers to standardized technology that suppresses signal emanations with shielding material. Vendors who manufacture this type of equipment must be certified to this standard. The devices (monitors, computers, printers, and so on) have an outer metal coating, referred to as a Faraday cage. This is made of metal with the necessary depth to ensure only a certain amount of radiation is released. In devices that are Tempest rated, other components are also modified, especially the power supply, to help reduce the amount of electricity used. Even allowable limits of emission levels can radiate and still be considered safe. The approved products must ensure only this level of emissions is allowed to escape the devices. This type of protection is usually needed only in military institutions, although other highly secured environments do utilize this kind of safeguard. Many military organizations are concerned with stray radio frequencies emitted by computers and other electronic equipment because an attacker may be able to pick them up, reconstruct them, and give away secrets meant to stay secret. Tempest technology is complex, cumbersome, and expensive, and therefore only used in highly sensitive areas that really need this high level of protection. Two alternatives to Tempest exist: use white noise or use a control zone concept, both of which are explained next. NOTE Tempest is the name of a program, and now a standard, that was developed in the late 1950s by the U.S. and British governments to deal with electrical and electromagnetic radiation emitted from electrical equipment, mainly computers. This type of equipment is usually used by intelligence, military, government, and law enforcement agencies, and the selling of such items is under constant scrutiny. White Noise A countermeasure used to combat intruders from extracting information from electrical transmissions is white noise. White noise is a uniform spectrum of random electrical signals. It is distributed over the full spectrum so the bandwidth is constant and an intruder is not able to decipher real information from random noise or random information.
ch04.indd 249
10/5/2007 11:49:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
250 Control Zone Another alternative to using Tempest equipment is to use the zone concept, which was addressed earlier in this chapter. Some facilities use material in their walls to contain electrical signals. This prevents intruders from being able to access information emitted via electrical signals from network devices. This control zone creates a type of security perimeter and is constructed to protect against unauthorized access to data or the compromise of sensitive information.
Access Control Monitoring Access control monitoring is a method of keeping track of who attempts to access specific company resources. It is an important detective mechanism, and different technologies exist that can fill this need. It is not enough to invest in antivirus and firewall solutions. Companies are finding that monitoring their own internal network has become a way of life.
Intrusion Detection Intrusion detection systems (IDSs) are different from traditional firewall products because they are designed to detect a security breach. Intrusion detection is the process of detecting an unauthorized use of, or attack upon, a computer, network, or telecommunications infrastructure. IDSs are designed to aid in mitigating the damage that can be caused by hacking, or breaking into sensitive computer and network systems. The basic intent of the IDS tool is to spot something suspicious happening on the network and sound an alarm by flashing a message on a network manager’s screen, or possibly sending a page or even reconfiguring a firewall’s ACL setting. The IDS tools can look for sequences of data bits that might indicate a questionable action or event, or monitor system log and activity recording files. The event does not need to be an intrusion to sound the alarm—any kind of “non-normal” behavior may do the trick. Although different types of IDS products are available, they all have three common components: sensors, analyzers, and administrator interfaces. The sensors collect traffic and user activity data and send them to an analyzer, which looks for suspicious activity. If the analyzer detects an activity it is programmed to deem as fishy, it sends an alert to the administrator’s interface. IDSs come in two main types: network-based, which monitor network communications, and host-based, which can analyze the activity within a particular computer system. IDSs can be configured to watch for attacks, parse audit logs, terminate a connection, alert an administrator as attacks are happening, protect system files, expose a hacker’s techniques, illustrate which vulnerabilities need to be addressed, and possibly help track down individual hackers.
Network-Based IDSs All the sailors love NIDS, because they are always in promiscuous mode. A network-based IDS (NIDS) uses sensors, which are either host computers with the necessary software installed or dedicated appliances—each with its network inter-
ch04.indd 250
10/5/2007 11:49:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
251 face card (NIC) in promiscuous mode. Normally, NICs watch for traffic that has the address of its host system, broadcasts, and sometimes multicast traffic. The NIC driver copies the data from the transmission medium and sends it up the network protocol stack for processing. When an NIC is put into promiscuous mode, the NIC driver captures all traffic, makes a copy of all packets and then passes one copy to the TCP stack and one copy to an analyzer to look for specific types of patterns. An NIDS monitors network traffic and cannot “see” the activity going on inside a computer itself. To monitor the activities within a computer system, a company would need to implement a host-based IDS.
Host-Based IDSs A host-based IDS (HIDS) can be installed on individual workstations and/or servers and watch for inappropriate or anomalous activity. HIDSs are usually used to make sure users do not delete system files, reconfigure important settings, or put the system at risk in any other way. So, whereas the NIDS understands and monitors the network traffic, a HIDS’s universe is limited to the computer itself. A HIDS does not understand or review network traffic, and a NIDS does not “look in” and monitor a system’s activity. Each has its own job and stays out of the other’s way. In most environments, HIDS products are installed only on critical servers, not on every system on the network, because of the resource overhead and the administration nightmare that such an installation would cause. Just to make life a little more confusing, HIDS and NIDS can be one of the following types: • Signature-based • Pattern matching • Stateful matching • Anomaly-based • Statistical anomaly–based • Protocol anomaly–based • Traffic anomaly–based • Rule-based
Knowledge- or Signature-Based Intrusion Detection Knowledge is accumulated by the IDS vendors about specific attacks and how they are carried out. Models of how the attacks are carried out are developed and called signatures. Each identified attack has a signature, which is used to detect an attack in progress or determine if one has occurred within the network. Any action that is not recognized as an attack is considered acceptable. NOTE
ch04.indd 251
Signature-based is also known as pattern matching.
10/5/2007 11:49:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
252 An example of a signature is a packet that has the same source and destination IP address. All packets should have a different source and destination IP address, and if they have the same address, this means a Land attack is under way. In a Land attack, a hacker modifies the packet header so that when a receiving system responds to the sender, it is responding to its own address. Now that seems as though it should be benign enough, but vulnerable systems just do not have the programming code to know what to do in this situation, so they freeze or reboot. Once this type of attack was discovered, the signature-based IDS vendors wrote a signature that looks specifically for packets that contain the same source and destination address. Signature-based IDS are the most popular IDS products today, and their effectiveness depends upon regularly updating the software with new signatures, as with antivirus software. This type of IDS is weak against new types of attacks because it can recognize only the ones that have been previously identified and have had signatures written for them. Attacks or viruses discovered in production environments are referred to as being “in the wild.” Attacks and viruses that exist but that have not been released are referred to as being “in the zoo.” No joke.
State-Based IDSs Before delving too deep into how a state-based IDS works, you need to understand what the state of a system or application actually is. Every change that an operating system experiences (user logs on, user opens application, application communicates to another application, user inputs data, and so on) is considered a state transition. In a very technical sense, all operating systems and applications are just lines and lines of instructions written to carry out functions on data. The instructions have empty variables, which is where the data is held. So when you use the calculator program and type in 5, an empty variable is instantly populated with this value. By entering that value, you change the state of the application. When applications communicate with each other, they populate empty variables provided in each application’s instruction set. So, a state transition is when a variable’s value changes, which usually happens continuously within every system. Specific state changes (activities) take place with specific types of attacks. If an attacker will carry out a remote buffer overflow, then the following state changes will occur: 1. The remote user connects to the system. 2. The remote user sends data to an application (the data exceed the allocated buffer for this empty variable). 3. The data are executed and overwrite the buffer and possibly other memory segments. 4. A malicious code executes. So, state is a snapshot of an operating system’s values in volatile, semipermanent, and permanent memory locations. In a state-based IDS, the initial state is the state prior to the execution of an attack, and the compromised state is the state after successful penetration. The IDS has rules that outline which state transition sequences should
ch04.indd 252
10/5/2007 11:49:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
253 sound an alarm. The activity that takes place between the initial and compromised state is what the state-based IDS looks for, and it sends an alert if any of the state-transition sequences match its preconfigured rules. This type of IDS scans for attack signatures in the context of a stream of activity instead of just looking at individual packets. It can only identify known attacks and requires frequent updates of its signatures.
Statistical Anomaly–Based IDS Through statistical analysis I have determined I am an anomaly in nature. Response: You have my vote. A statistical anomaly–based IDS is a behavioral-based system. Behavioral-based IDS products do not use predefined signatures, but rather are put in a learning mode to build a profile of an environment’s “normal” activities. This profile is built by continually sampling the environment’s activities. The longer the IDS is put in a learning mode, in most instances, the more accurate a profile it will build and the better protection it will provide. After this profile is built, all future traffic and activities are compared to it. The same type of sampling that was used to build the profile takes place, so the same type of data is being compared. Anything that does not match the profile is seen as an attack, in response to which the IDS sends an alert. With the use of complex statistical algorithms, the IDS looks for anomalies in the network traffic or user activity. Each packet is given an anomaly score, which indicates its degree of irregularity. If the score is higher than the established threshold of “normal” behavior, then the preconfigured action will take place. The benefit of using a statistical anomaly–based IDS is that it can react to new attacks. It can detect “0 day” attacks, which means an attack is new to the world and no signature or fix has been developed yet. These products are also capable of detecting the “low and slow” attacks, in which the attacker is trying to stay under the radar by sending packets little by little over a long period of time. The IDS should be able to detect these types of attacks because they are different enough from the contrasted profile. Now for the bad news. Since the only thing that is “normal” about a network is that it is constantly changing, developing the correct profile that will not provide an overwhelming number of false positives can be difficult. Many IT staff members know all too well this dance of chasing down alerts that end up being benign traffic or activity. In fact, some environments end up turning off their IDS because of the amount of time these activities take up. (Proper education on tuning and configuration will reduce the number of false positives.) If an attacker detects there is an IDS on a network, she will then try to detect the type of IDS it is so she can properly circumvent it. With a behavioral-based IDS, the attacker could attempt to integrate her activities into the behavior pattern of the network traffic. That way, her activities are seen as “normal” by the IDS and thus go undetected. It is a good idea to ensure no attack activity is underway when the IDS is in learning mode. If this takes place, the IDS will never alert you of this type of attack in the future because it sees this traffic as typical of the environment. If a corporation decides to use a statistical anomaly–based IDS, it must ensure that the staff members who are implementing and maintaining it understand protocols and
ch04.indd 253
10/5/2007 11:49:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
254 packet analysis. Because this type of an IDS sends generic alerts, compared to other types of IDSs, it is up to the network engineer to figure out what the actual issue is. For example, a signature-based IDS reports the type of attack that has been identified, while a rule-based IDS identifies the actual rule the packet does not comply with. In a statistical anomaly–based IDS, all the product really understands is that something “abnormal” has happened, which just means the event does not match the profile. NOTE A behavior-based IDS is also referred to as a heuristic IDS. The term heuristic means to create new information from different data sources. The IDS gathers different “clues” from the network or system and calculates the probability an attack is taking place. If the probability hits a set threshold, then the alarm sounds.
Attack Techniques It is common for hackers to first identify whether an IDS is present on the network they are preparing to attack. If one is present, that attacker may implement a Denial-of-Service attack to bring it offline. Another tactic is to send the IDS incorrect data, which will make the IDS send specific alerts indicating a certain attack is under way, when in truth it is not. The goal of these activities is either to disable the IDS or to distract the network and security individuals so they will be busy chasing the wrong packets, while the real attack takes place.
What’s in a Name? Signature-based IDSs are also known as misuse-detection systems, and behavioral-based IDSs are also known as profile-based systems. Determining the proper thresholds for statistically significant deviations is really the key for the successful use of a behavioral-based IDS. If the threshold is set too low, nonintrusive activities are considered attacks (false positives). If the threshold is set too high, some malicious activities won’t be identified (false negatives). Once an IDS discovers an attack, several things can happen, depending upon the capabilities of the IDS and the policy assigned to it. The IDS can send an alert to a console to tell the right individuals an attack is being carried out; send an e-mail or page to the individual assigned to respond to such activities; kill the connection of the detected attack; or reconfigure a router or firewall to try to stop any further similar attacks. A modifiable response condition might include anything from blocking a specific IP address to redirecting or blocking a certain type of activity.
Protocol Anomaly–Based IDS A statistical anomaly–based IDS can use protocol anomaly–based filters. These types of IDSs have specific knowledge of each protocol they will monitor. A protocol anomaly pertains to the format and behavior of a protocol. The IDS builds a model (or profile) of each protocol’s “normal” usage. Keep in mind, however, that protocols have theoretical usage, as outlined in their corresponding RFCs, and real-world usage, which refers to
ch04.indd 254
10/5/2007 11:49:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
255 the fact that vendors seem to always “color outside the boxes” and don’t strictly follow the RFCs in their protocol development and implementation. So, most profiles of individual protocols are a mix between the official and real-world versions of the protocol and its usage. When the IDS is activated, it looks for anomalies that do not match the profiles built for the individual protocols. Although several vulnerabilities within operating systems and applications are available to be exploited, many more successful attacks take place by exploiting vulnerabilities in the protocols themselves. At the OSI data link layer, the Address Resolution Protocol (ARP) does not have any protection against ARP attacks where bogus data is inserted into its table. At the network layer, the Internet Control Message Protocol (ICMP) can be used in a Loki attack to move data from one place to another, when this protocol was designed to only be used to send status information—not user data. IP headers can be easily modified for spoofed attacks. At the transport layer, TCP packets can be injected into the connection between two systems for a session hijacking attack. NOTE When an attacker compromises a computer and loads a backdoor on the system, he will need to have a way to communicate to this computer through this backdoor and stay “under the radar” of the network firewall and IDS. Hackers have figured out that a small amount of code can be inserted into an ICMP packet, which is then interpreted by the backdoor software loaded on a compromised system. Security devices are usually not configured to monitor this type of traffic because ICMP is a protocol that is supposed to be used just to send status information—not commands to a compromised system. Because every packet formation and delivery involves many protocols, and because more attack vectors exist in the protocols than in the software itself, it is a good idea to integrate protocol anomaly–based filters in any network behavioral-based IDS.
Traffic Anomaly–Based IDS Most behavioral-based IDSs have traffic anomaly–based filters, which detect changes in traffic patterns as in DoS attacks or a new service that appears on the network. Once a profile is built that captures the baselines of an environment’s ordinary traffic, all future traffic patterns are compared to that profile. As with all filters, the thresholds are tunable to adjust the sensitivity, and to reduce the number of false positives and false negatives. Since this is a type of statistical anomaly–based IDS, it can detect unknown attacks.
Rule-Based IDS A rule-based IDS takes a different approach than a signature-based or statistical anomaly–based system. A signature-based IDS is very straightforward. For example, if a signature-based IDS detects a packet that has all of its TCP header flags with the bit value of 1, it knows that an xmas attack is underway—so it sends an alert. A statistical anomaly–based IDS is also straightforward. For example, if Bob has logged on to his computer at 6 A.M. and the profile indicates this is abnormal, the IDS sends an alert, because this is seen as an activity that needs to be investigated. Rule-based intrusion detection gets a little trickier, depending upon the complexity of the rules used.
ch04.indd 255
10/5/2007 11:49:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
256 Rule-based intrusion detection is commonly associated with the use of an expert system. An expert system is made up of a knowledge base, inference engine, and rulebased programming. Knowledge is represented as rules, and the data to be analyzed are referred to as facts. The knowledge of the system is written in rule-based programming (IF situation THEN action). These rules are applied to the facts, the data that comes in from a sensor, or a system that is being monitored. For example, in scenario 1 the IDS pulls data from a system’s audit log and stores it temporarily in its fact database, as illustrated in Figure 4-22. Then, the preconfigured rules are applied to this data to indicate whether anything suspicious is taking place. In our scenario, the rule states “IF a root user creates File1 AND creates File2 SUCH THAT they are in the same directory THEN there is a call to Administrative Tool1 TRIGGER send alert.” This rule has been defined such that if a root user creates two files in the same directory and then makes a call to a specific administrative tool, an alert should be sent. It is the inference engine that provides some artificial intelligence into this process. An inference engine can infer new information from provided data by using inference rules. To understand what inferring means in the first place, let’s look at the following; Socrates is a man. All men are mortals. Thus, we can infer that Socrates is mortal. If you are asking “What does this have to do with a hill of beans?” just hold on to your hat—here we go. Regular programming languages deal with the “black and white” of life. The answer is either yes or no, not maybe this or maybe that. Although computers can carry out complex computations at a much faster rate than humans, they have a harder time guessing, or inferring, answers because they are very structured. The fifth-generation programming languages (artificial intelligence languages) are capable of dealing with the grayer areas of life and can attempt to infer the right solution from the provided data.
Figure 4-22 Rule-based IDS and expert system components
ch04.indd 256
10/5/2007 11:49:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
257 So, in a rule-based IDS founded on an expert system, the IDS gathers data from a sensor or log, and the inference engine uses its preprogrammed rules on it. If the characteristics of the rules are met, an alert or solution is provided.
IDS Types It is important to understand the characteristics that make the different types of IDS technologies distinct. The following is a summary: • Signature-based • Pattern matching, similar to antivirus software • Signatures must be continuously updated • Cannot identify new attacks • Two types: • Pattern matching
Compares packets to signatures
• Stateful matching Compares patterns to several activities at once • Anomaly-based • Behavioral-based system that learns the “normal” activities of an environment • Can detect new attacks • Also called behavior- or heuristic-based • Three types: • Statistical anomaly–based Creates a profile of “normal” and compares activities to this profile • Protocol anomaly–based Identifies protocols used outside of their common bounds • Traffic anomaly–based Identifies unusual activity in network traffic • Rule-based • Use of IF/THEN rule-based programming within expert systems • Use of an expert system allows for artificial intelligence characteristics • The more complex the rules, the more demands on software and hardware processing requirements • Cannot detect new attacks
ch04.indd 257
10/5/2007 11:49:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
258 References • “The Science of IDS Attack Identification” (Cisco Systems whitepaper) www.cisco.com/en/US/products/sw/secursw/ps976/products_white_ paper09186a0080092334.shtml • “Intrusion Detection Terminology (Part Two),” by Andy Cuff (SecurityFocus Infocus Archive, last updated Sept. 24, 2003) www.securityfocus.com/ infocus/1733 • Honeypots.net IDS Software links page www.honeypots.net/ids/products • “State of the Practice of Intrusion Detection Technologies,” by Julia Allen, et al., Software Engineering Institute, Carnegie Mellon University (Jan. 1999) www.sei.cmu.edu/publications/documents/99.reports/99tr028/ 99tr028abstract.html
IDS Sensors Network-based IDSs use sensors for monitoring purposes. A sensor, which works as an analysis engine, is placed on the network segment the IDS is responsible for monitoring. The sensor receives raw data from an event generator, as shown in Figure 4-23, and compares it to a signature database, profile, or model, depending upon the type of IDS. If there is some type of a match, which indicates suspicious activity, the sensor works with the response module to determine what type of activity must take place (alerting through instant messaging, paging, or by e-mail, carrying out firewall reconfiguration, and so on). The sensor’s role is to filter received data, discard irrelevant information, and detect suspicious activity.
Switched Environments NIDSs have a harder time working on a switched network, compared to traditional nonswitched environments, because data are transferred through independent virtual circuits and not broadcasted, as in nonswitched environments. The IDS sensor acts as a sniffer and does not have access to all the traffic in these individual circuits. So, we have to take all the data on each individual virtual private connection, make a copy of it, and put the copies of the data on one port (spanning port) where the sensor is located. This allows the sensor to have access to all the data going back and forth on a switched network. A monitoring console monitors all sensors and supplies the network staff with an overview of the activities of all the sensors in the network. These are the components that enable network-based intrusion detection to actually work. Sensor placement is a critical part of configuring an effective IDS. An organization can place a sensor outside of the firewall to detect attacks and place a sensor inside the firewall (in the perimeter network) to detect actual intrusions. Sensors should also be placed in highly sensitive
ch04.indd 258
10/5/2007 11:49:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
259
Figure 4-23 The basic architecture of an NDIS
areas, DMZs, and on extranets. Figure 4-24 shows the sensors reporting their findings to the central console. The IDS can be centralized, as firewall products that have IDS functionality integrated within them, or distributed, with multiple sensors throughout the network.
Network Traffic If the network traffic volume exceeds the IDS system’s threshold, attacks may go unnoticed. Each vendor’s IDS product has its own threshold, and you should know and understand that threshold before you purchase and implement the IDS. In very high-traffic environments, multiple sensors should be in place to ensure all packets are investigated. If necessary to optimize network bandwidth and speed, different sensors can be set up to analyze each packet for different signatures. That way, the analysis load can be broken up over different points.
ch04.indd 259
10/5/2007 11:49:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
260
Figure 4-24 Sensors must be placed in each network segment to be monitored by the IDS.
Intrusion Prevention Systems An ounce of prevention does something good. Response: Yeah, causes a single point of failure. In the industry, there is constant frustration with the inability of existing products to stop the bad guys from accessing and manipulating corporate assets. This has created a market demand for vendors to get creative and come up with new, innovative technologies and new products for companies to purchase, implement, and still be frustrated with. The next “big thing” in the IDS arena is the intrusion prevention system (IPS). The traditional IDS only detects that something bad may be taking place and sends an alert. The goal of an IPS is to detect this activity and not allow the traffic to gain access to the target in the first place, as shown in Figure 4-25. So, an IPS is a preventative and proactive technology, whereas an IDS is a detective and after-the-fact technology. As of this writing, the industry is debating what the real definition of IPS is, and many vendors are attempting to be the king of the hill in this market. But the general concept of the definition is agreed upon, which is a focus on prevention rather than detection. The goal is to combine into one product the “stop the packets in their tracks” functionality that firewalls provide with the in-depth packet analysis that an IDS provides. As within the IDS arena, there are host-based IPS products and network-based IPS products. A majority of the network-based IPS products are inline devices, which means all traffic must go through and be monitored by the IPS before proceeding any further down its path. This is a concern for many companies because any inline device can be a traffic bottleneck, reduce performance, and pose a single point of failure. (Vendors are working hard to provide technologies to deal with each of these issues.)
ch04.indd 260
10/5/2007 11:49:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
261
Figure 4-25 IDS vs. IPS architecture
Intrusion Responses Most IDSs are capable of several types of response to a triggered event. An IDS can send out a special signal to drop or kill the packet connections at both the source and destinations. This effectively disconnects the communication and does not allow it to be transmitted. An IDS might block a user from accessing a resource on a host system, if the threshold is set to trigger this response. An IDS can send alerts of an event trigger to other hosts, IDS monitors, and administrators. And, finally, some IDSs can reconfigure themselves to perform some predefined action. Most NIPSs have two NICs, external and internal facing. Traffic arrives on the external NIC and is analyzed by the engine. If the packets are deemed safe, they go on their way out the internal-facing NIC. If the packets are deemed malicious, the packet is discarded. Only time will tell whether IPS products will fully replace IDS products. Some people feel as though it is just a new term for marketing purposes, whereas others feel it is the next step in our evolution of information and computer security technology advances. The rest of us should just get some popcorn and watch how this play unfolds.
References • “Intrusion Prevention Versus Intrusion Detection,” by Markus DeShon (SecureWorks whitepaper) www.netbankaudit.com/images/IPSvsIDS_ White_Paper.pdf • “Intrusion Prevention Systems: The next step in the evolution of IDS,” by Neil Desai (SecurityFocus Infocus Archive, last updated Feb. 27, 2003) www.securityfocus.com/infocus/1670
ch04.indd 261
10/5/2007 11:49:10 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
262 • “Intrusion Prevention Systems (IPS), Part 1: Deciphering the inline Intrusion Prevention hype, and working toward a real-world, proactive security solution” (Secure Computing whitepaper, 2003) www.securecomputing.com/pdf/ Intru-Preven-WP1-Aug03-vF.pdf • “Rule-Based Intrusion Detection,” from the Software Engineering Institute (SEI) Software Technology Roadmap www.sei.cmu.edu/str/descriptions/ rbid.html
Honeypot Hey, curious, ill-willed, and destructive attackers, look at this shiny new vulnerable computer. A honeypot is a computer set up as a sacrificial lamb on the network. The system is not locked down and has open ports and services enabled. This is to entice a would-be attacker to this computer instead of attacking authentic production systems on a network. The honeypot contains no real company information, and thus will not be at risk if and when it is attacked. This enables the administrator to know when certain types of attacks are happening so he can fortify the environment and perhaps track down the attacker. The longer the hacker stays at the honeypot, the more information will be disclosed about her techniques. It is important to draw a line between enticement and entrapment when implementing a honeypot system. Legal and liability issues surround each. If the system only has open ports and services that an attacker might want to take advantage of, this would be an example of enticement. If the system has a web page indicating the user can download files, and once the user does this the administrator charges this user with trespassing, it would be entrapment. Entrapment is where the intruder is induced or tricked into committing a crime. Entrapment is illegal and cannot be used when charging an individual with hacking or unauthorized activity.
References • The Honeynet Project http://project.honeynet.org • “What Is a Honeypot?” by Loras Even, SANS (July 12, 2000) www.sans.org/ resources/idfaq/honeypot3.php
Network Sniffers I think I smell a packet! Response: Nope. It’s my feet. A packet or network sniffer is a general term for programs or devices able to examine traffic on a LAN segment. Traffic that is being transferred over a network medium is transmitted as electrical signals, encoded in binary representation. The sniffer has to have a protocol-analysis capability to recognize the different protocol values to properly interpret their meaning. The sniffer has to have access to a network adapter that works in promiscuous mode, and a driver that captures the data. This data can be overwhelming, so it must be properly filtered. The filtered data are stored in a buffer, and this information is displayed to a user and/or captured in logs. Some utilities have sniffer and packet-modification capabilities, which is how some types of spoofing and man-in-the-middle attacks are carried out.
ch04.indd 262
10/5/2007 11:49:10 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
263 Network sniffers are used by the people in the white hats (administrators and security professionals) usually to try and track down a recent problem with the network. But the guys in the black hats (attackers and crackers) can use them to learn about what type of data is passed over a specific network segment and to modify data in an unauthorized manner. Black hats usually use sniffers to obtain credentials as they pass over the network medium. NOTE Sniffers are dangerous because they are very hard to detect and their activities are difficult to audit.
A Few Threats to Access Control As a majority of security professionals know, there is more risk and a higher probability of an attacker causing mayhem from within an organization than from outside it. However, many people within organizations do not know this fact, because they only hear stories about the outside attackers who defaced a web server or circumvented a firewall to access confidential information. An attacker from the outside can enter through remote access entry points, enter through firewalls and web servers, physically break in, or exploit a partner communication path (extranet, vendor connection, and so on). An insider has legitimate reasons for using the systems and resources, but can misuse his privileges and launch an actual attack also. The danger of insiders is that they have already been given a wide range of access that a hacker would have to work to obtain; they probably have intimate knowledge of the environment; and, generally, they are trusted. We have discussed many different types of access control mechanisms that work to keep the outsiders outside and restrict insiders’ abilities to a minimum and audit their actions. Now we will look at some specific attacks commonly carried out in environments today by insiders or outsiders.
Dictionary Attack Several programs can enable an attacker (or proactive administrator) to identify user credentials. This type of program is fed lists (dictionaries) of commonly used words or combinations of characters, and then compares these values to capture passwords. In other words, the program hashes the dictionary words and compares the resulting message digest with the system password file that also stores its passwords in a one-way hashed format. If the hashed values match, it means a password has just been uncovered. Once the right combination of characters is identified, the attacker can use this password to authenticate herself as a legitimate user. Because many systems have a threshold that dictates how many failed logon attempts are acceptable, the same type of activity can happen to a captured password file. The dictionary-attack program hashes the combination of characters and compares it to the hashed entries in the password file. If a match is found, the program has uncovered a password. The dictionaries come with the password cracking programs, and extra dictionaries can be found on several sites on the Internet.
ch04.indd 263
10/5/2007 11:49:10 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
264 NOTE Passwords should never be transmitted or stored in cleartext. Most operating systems and applications put the passwords through hashing algorithms, which result in hash values, also referred to as message digest values.
Countermeasures To properly protect an environment against dictionary and other password attacks, the following practices should be followed: • Do not allow passwords to be sent in cleartext. • Encrypt the passwords with encryption algorithms or hashing functions. • Employ one-time password tokens. • Use hard-to-guess passwords. • Rotate passwords frequently. • Employ an IDS to detect suspicious behavior. • Use dictionary cracking tools to find weak passwords chosen by users. • Use special characters, numbers, and upper- and lowercase letters within the password. • Protect password files.
Brute Force Attacks I will try over and over until you are defeated. Response: Okay, wake me when you are done. Several types of brute force attacks can be implemented, but each continually tries different inputs to achieve a predefined goal. Brute force is defined as “trying every possible combination until the correct one is identified.” So in a brute force password attack, the software tool will see if the first letter is an “a” and continue through the alphabet until that single value is uncovered. Then the tool moves on to the second value and so on. The most effective way to uncover passwords is through a hybrid attack, which combines a dictionary attack and a brute force attack. If a dictionary tool has found that a user’s password starts with Dallas, then the brute force tool will try Dallas1, Dallas01, Dallasa1, and so on until a successful logon credential is uncovered. (A brute force attack is also known as an exhaustive attack.) These attacks are also used in wardialing efforts, in which the wardialer inserts a long list of phone numbers into a wardialing program in hopes of finding a modem that can be exploited to gain unauthorized access. A program is used to dial many phone numbers and weed out the numbers used for voice calls and fax machine services. The attacker usually ends up with a handful of numbers he can now try to exploit to gain access into a system or network. So, a brute force attack perpetuates a specific activity with different input parameters until the goal is achieved.
ch04.indd 264
10/5/2007 11:49:11 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
265 Countermeasures For phone brute force attacks, auditing and monitoring of this type of activity should be in place to uncover patterns that could indicate a wardialing attack: • Perform brute force attacks to find weaknesses and hanging modems. • Make sure only necessary phone numbers are made public. • Provide stringent access control methods that would make brute force attacks less successful. • Monitor and audit for such activity. • Employ an IDS to watch for suspicious activity. • Set lockout thresholds.
Spoofing at Logon So, what are your credentials again? An attacker can use a program that presents to the user a fake logon screen, which often tricks the user into attempting to log on. The user is asked for a username and password, which are stored for the attacker to access at a later time. The user does not know this is not his usual logon screen because they look exactly the same. A fake error message can appear, indicating that the user mistyped his credentials. At this point, the fake logon program exits and hands control over to the operating system, which prompts the user for a username and password. The user assumes he mistyped his information and doesn’t give it a second thought, but an attacker now knows the user’s credentials.
Phishing Hello, this is your bank. Hand over your SSN, credit card number, and your shoe size. Response: Okay, that sounds honest enough. Phishing is a type of social engineering with the goal of obtaining personal information, credentials, credit card number, or financial data. The attackers lure, or fish, for sensitive data through various different methods. The term phishing was coined in 1996 when hackers started stealing America Online (AOL) passwords. The hackers would pose as AOL staff members and send messages to victims asking them for their passwords in order to verify correct billing information or verify information about the AOL accounts. Once the password was provided, the hacker authenticated as that victim and used his e-mail account for criminal purposes as in spamming, pornography, and so on. Although phishing has been around since the 1990s, many people did not fully become aware of it until mid-2003 when these types of attacks spiked. Phishers created convincing e-mails requesting potential victims to click a link to update their bank account information. Victims click these links and are presented with a form requesting bank account numbers, Social Security numbers, credentials, and other types of data that can be used
ch04.indd 265
10/5/2007 11:49:11 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
266 in identity theft crimes. These types of phishing e-mail scams have increased dramatically in recent years with some phishers masquerading as large banking companies, PayPal, e-Bay, Amazon.com, and other well-known Internet entities. Phishers also create web sites that look very similar to legitimate sites and lure victims to them through e-mail messages and other web sites to gain the same type of information. Some sites require the victims to provide their Social Security numbers, date of birth, and mother’s maiden name for authentication purposes before they can update their account information. The nefarious web sites not only have the look and feel of the legitimate web site, but attackers would provide URLs with domain names that look very similar to the legitimate site’s address. For example, www.amazon.com might become www.amzaon .com. Or use a specially placed @ symbol. For example,
[email protected] would actually take the victim to the web site notmsn.com and provide the username of www.msn.com to this web site. The username www.msn.com would not be a valid username for notmsn.com, so the victim would just be shown the home page of notmsn.com. Now, notmsn.com is a nefarious site and created to look and feel just like www.msn.com. The victim feels comfortable he is at a legitimate site and logs in with his credentials. Some JavaScript commands are even designed to show the victim an incorrect web address. So let’s say Bob is a suspicious and vigilant kind of a guy. Before he inputs his username and password to authenticate and gain access to his online bank account, he always checks the URL values in the address bar of his browser. Even though he closely inspects it to make sure he is not getting duped, there could be a JavaScript replacing the URL www.evilandwilltakeallyourmoney.com with www.citibank.com so he thinks things are safe and life is good. NOTE There have been fixes to the previously mentioned attack dealing with URLs, but it is important to know that attackers will continually come up with new ways of carrying out these attacks. Just knowing about phishing doesn’t mean you can properly detect or prevent it. As a security professional, you must keep up with the new and tricky strategies deployed by attackers. Some attacks use pop-up forms when a victim is at a legitimate site. So if you were at your bank’s actual web site and a pop-up window appeared asking you for some sensitive information. This probably wouldn’t worry you since you were communicating with your actual bank’s web site. You may believe the window came from your bank’s web server, so you fill it out as instructed. Unfortunately, this pop-up window could be from another source entirely, and your data could be placed right in the attacker’s hands, not your bank’s. With this personal information, phishers can create new accounts in the victim’s name, gain authorized access to bank accounts, and make illegal credit card purchases or cash advances. In 2004, Gartner reported that phishing scams cost businesses and consumers around $2.4 billion in 2003. Gartner estimated that 57 million people in the U.S. received a phishing e-mail and 1.8 million responded with personal information.
ch04.indd 266
10/5/2007 11:49:11 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
267 CAUTION Attackers also install key loggers on systems to gather victims’ credentials, Social Security numbers, and bank account information. Key loggers are pieces of software that capture all the keystrokes a user types in. As more people have become aware of these types of attacks and grown wary of clicking embedded links in e-mail messages, phishers have varied their attack methods. For instance, they began sending e-mails that indicate to the user that they have won a prize or that there is a problem with a financial account. The e-mail instructs the person to call a number, which has an automated voice asking the victim to type in their credit card number or Social Security number for authentication purposes. In 2006, at least 35 phishing web sites were identified that carried out attacks on many banks’ token-based authentication systems. Federal guidelines requested that financial institutions implement two-factor authentication for online transactions. To meet this need, some banks provided their customers with token devices that created one-time passwords. Countering, phishers set up fake web sites that looked like the financial institution, duping victims into typing their one-time passwords. The web sites would then send these credentials to the actual bank web site, authenticate as this user, and gain access to their account. A similar type of attack is called pharming, which redirects a victim to a seemingly legitimate, yet fake, web site. In this type of attack, the attacker carries out something called DNS poisoning, in which a DNS server resolves a host name into an incorrect IP address. When you type www.logicalsecurity.com into the address bar of your web browser, your computer really has no idea what this data is. So an internal request is made to review your TCP/IP network setting, which contains the IP address of the DNS server your computer is supposed to use. Your system then sends a request to this DNS server basically asking “Do you have the IP address for www.logicalsecurity.com?” The DNS server reviews its resource records and if it has one with this information in it, it sends the IP address for the server that is hosting www.logicalsecurity.com to your computer. Your browser then shows the home page of this web site you requested. Now, what if an attacker poisoned this DNS server so the resource record has the wrong information? When you type in www.logicalsecurity.com and your system sends a request to the DNS server, the DNS server will send your system the IP address that it has recorded, not knowing it is incorrect. So instead of going to www.logicalsecurity .com, you are sent to www.bigbooty.com. This could make you happy or sad, depending upon your interests, but you are not at the site you requested. So, let’s say the victim types in a web address of www.nicebank.com, as illustrated in Figure 4-26. The victim’s system sends a request to a poisoned DNS server, which points the victim to a different web site. This different web site looks and feels just like the requested web site, so the user enters his username and password and may even be presented with web pages that look legitimate. The benefit of a pharming attack to the attacker is that it can affect a large amount of victims without the need for sending out e-mails, and the victims usually fall for this more easily since they are requesting to go to a web site themselves.
ch04.indd 267
10/5/2007 11:49:12 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
268
Figure 4-26 Pharming has been a common attack over the last couple of years
Identity Theft I’m glad someone stole my identity. I’m tired of being me. Identity theft refers to a situation where someone obtains key pieces of personal information such as a driver’s license number, bank account number, credentials, or Social Security number, and then uses that information to impersonate someone else. Typically, identity thieves will use the personal information to obtain credit, merchandise, services in the name of the victim, or false credentials for the thief. This can result in such things as ruining the victim’s credit rating, generating false criminal records, and issuing arrest warrants for the wrong individuals. Identity theft is categorized in two ways: true name and account takeover. True name identity theft means the thief uses personal information to open new accounts. The thief might open a new credit card account, establish cellular phone service, or open a new checking account in order to obtain blank checks. Account takeover identity theft means the imposter uses personal information to gain access to the person’s existing accounts. Typically, the thief will change the mailing address on an account and run up a huge bill before the person, whose identity has been stolen, realizes there is a problem. The Internet has made it easier for an identity thief to use the information they’ve stolen because transactions can be made without any personal interaction. Countermeasures to phishing attacks include the following: • Be skeptical of e-mails indicating you must make changes to your accounts, or warnings stating an account will be terminated if you don’t perform some online activity.
ch04.indd 268
10/5/2007 11:49:12 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
269 • Call the legitimate company to find out if this is a fraudulent message. • Review the address bar to see if the domain name is correct. • When submitting any type of financial information or credential data, an SSL connection should be set up, which is indicated in the address bar (https://) and a closed-padlock icon in the browser at the bottom-right corner. • Do not click an HTML link within an e-mail. Type the URL out manually instead. • Do not accept e-mail in HTML format.
Summary Access controls are security features that are usually considered the first line of defense in asset protection. They are used to dictate how subjects access objects, and their main goal is to protect the objects from unauthorized access. These controls can be administrative, physical, or technical in nature and can supply preventive, detective, deterrent, recovery, compensative, and corrective services. Access control defines how users should be identified, authenticated, and authorized. These issues are carried out differently in different access control models and technologies, and it is up to the organization to determine which best fits its business and security needs.
Quick Tips • Access is a flow of information between a subject and an object. • A subject is an active entity that requests access to an object, which is a passive entity. • A subject can be a user, program, or process. • Confidentiality is the assurance that information is not disclosed to unauthorized subjects. • Some security mechanisms that provide confidentiality are encryption, logical and physical access control, transmission protocols, database views, and controlled traffic flow. • Identity management solutions include directories, web access management, password management, legacy single sign-on, account management, and profile update. • Password synchronization reduces the complexity of keeping up with different passwords for different systems. • Self-service password reset reduces help-desk call volumes by allowing users to reset their own passwords. • Assisted password reset reduces the resolution process for password issues for the help-desk department. • IdM directories contain all resource information, users’ attributes, authorization profiles, roles, and possibly access control policies so other IdM applications have one centralized resource from which to gather this information.
ch04.indd 269
10/5/2007 11:49:12 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
270 • An automated workflow component is common in account management products that provide IdM solutions. • User provisioning refers to the creation, maintenance, and deactivation of user objects and attributes, as they exist in one or more systems, directories, or applications. • The HR database is usually considered the authoritative source for user identities because that is where it is first developed and properly maintained. • There are three main access control models: discretionary, mandatory, and nondiscretionary. • Discretionary access control (DAC) enables data owners to dictate what subjects have access to the files and resources they own. • Mandatory access control (MAC) uses a security label system. Users have clearances, and resources have security labels that contain data classifications. MAC compares these two attributes to determine access control capabilities. • Nondiscretionary access control uses a role-based method to determine access rights and permissions. • Role-based access control is based on the user’s role and responsibilities within the company. • Three main types of restricted interface measurements exist: menus and shells, database views, and physically constrained interfaces. • Access control lists are bound to objects and indicate what subjects can use them. • A capability table is bound to a subject and lists what objects it can access. • Access control can be administered in two main ways: centralized and decentralized. • Some examples of centralized administration technologies are RADIUS, TACACS+, and Diameter. • A decentralized administration example is a peer-to-peer working group. • Examples of administrative controls are a security policy, personnel controls, supervisory structure, security-awareness training, and testing. • Examples of physical controls are network segregation, perimeter security, computer controls, work area separation, data backups, and cable. • Examples of technical controls are system access, network architecture, network access, encryption and protocols, and auditing. • Access control mechanisms provide one or more of the following functionalities: preventive, detective, corrective, deterrent, recovery, or compensative. • For a subject to be able to access a resource, it must be identified, authenticated, authorized, and should be held accountable for its actions. • Authentication can be accomplished by biometrics, a password, a passphrase, a cognitive password, a one-time password, or a token.
ch04.indd 270
10/5/2007 11:49:13 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
271 • A Type I error in biometrics means the system rejected an authorized individual, and a Type II error means an imposter was authenticated. • A memory card cannot process information, but a smart card can. • Access controls should default to no access. • Least-privilege and need-to-know principles limit users’ rights to only what is needed to perform tasks of their job. • Single sign-on technology requires a user to be authenticated to the network only one time. • Single sign-on capabilities can be accomplished through Kerberos, SESAME, domains, and thin clients. • In Kerberos, a user receives a ticket from the KDC so they can authenticate to a service. • The Kerberos user receives a ticket granting ticket (TGT), which allows him to request access to resources through the ticket granting service (TGS). The TGS generates a new ticket with the session keys. • Types of access control attacks include Denial of Service, spoofing, dictionary, brute force, and wardialing. • Audit logs can track user activities, application events, and system events. • Keystroke monitoring is a type of auditing that tracks each keystroke made by a user. • Audit logs should be protected and reviewed. • Object reuse can unintentionally disclose information. • Just removing pointers to files is not always enough protection for proper object reuse. • Information can be obtained via electrical signals in airwaves. The ways to combat this type of intrusion are Tempest, white noise, and control zones. • User authentication is accomplished by what someone knows, is, or has. • One-time password-generating token devices can use synchronous or asynchronous methods. • Strong authentication requires two of the three user authentication attributes (what someone knows, is, or has). • Kerberos addresses privacy and integrity but not availability. • The following are weaknesses of Kerberos: the KDC is a single point of failure; it is susceptible to password guessing; session and secret keys are locally stored; KDC needs to always be available; and there must be management of secret keys. • IDSs can be statistical (monitor behavior) or signature-based (watch for known attacks).
ch04.indd 271
10/5/2007 11:49:13 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
272 • Degaussing is a safeguard against disclosure of confidential information because it returns media back to its original state. • Phishing is a type of social engineering with the goal of obtaining personal information, credentials, credit card number, or financial data.
Questions Please remember that these questions are formatted and asked in a certain way for a reason. Remember that the CISSP exam is asking questions at a conceptual level. Questions may not always have the perfect answer, and the candidate is advised against always looking for the perfect answer. Instead, the candidate should look for the best answer in the list. 1. Which of the following statements correctly describes biometric methods? A. They are the least expensive and provide the most protection. B. They are the most expensive and provide the least protection. C. They are the least expensive and provide the least protection. D. They are the most expensive and provide the most protection. 2. What is derived from a passphrase? A. Personal password B. Virtual password C. User ID D. Valid password 3. Which of the following statements correctly describes passwords? A. They are the least expensive and most secure. B. They are the most expensive and least secure. C. They are the least expensive and least secure. D. They are the most expensive and most secure. 4. What is the reason for enforcing the separation of duties? A. No one person can complete all the steps of a critical activity. B. It induces an atmosphere for collusion. C. It increases dependence on individuals. D. It makes critical tasks easier to accomplish. 5. Which of the following is not a logical access control? A. Encryption B. Network architecture C. ID badge D. Access control matrix
ch04.indd 272
10/5/2007 11:49:13 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
273 6. An access control model should be applied in a _______________ manner. A. Detective B. Recovery C. Corrective D. Preventive 7. Which access control policy is enforced when an environment uses a nondiscretionary model? A. Rule-based B. Role-based C. Identity-based D. Mandatory 8. How is a challenge/response protocol utilized with token device implementations? A. This protocol is not used; cryptography is used. B. An authentication service generates a challenge, and the smart token generates a response based on the challenge. C. The token challenges the user for a username and password. D. The token challenges the user’s password against a database of stored credentials. 9. Which access control method is user-directed? A. Nondiscretionary B. Mandatory C. Identity-based D. Discretionary 10. Which provides the best authentication? A. What a person knows B. What a person is C. What a person has D. What a person has and knows 11. Which item is not part of a Kerberos authentication implementation? A. Message authentication code B. Ticket granting service C. Authentication service D. Users, programs, and services
ch04.indd 273
10/5/2007 11:49:13 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
274 12. Which model implements access control matrices to control how subjects interact with objects? A. Mandatory B. Centralized C. Decentralized D. Discretionary 13. What does authentication mean? A. Registering a user B. Identifying a user C. Validating a user D. Authorizing a user 14. If a company has a high turnover rate, which access control structure is best? A. Role-based B. Decentralized C. Rule-based D. Discretionary 15. A password is mainly used for what function? A. Identity B. Registration C. Authentication D. Authorization 16. The process of mutual authentication involves _______________. A. A user authenticating to a system and the system authenticating to the user B. A user authenticating to two systems at the same time C. A user authenticating to a server and then to a process D. A user authenticating, receiving a ticket, and then authenticating to a service 17. Reviewing audit logs is an example of which security function? A. Preventive B. Detective C. Deterrence D. Corrective 18. In discretionary access control security, who has delegation authority to grant access to data? A. User B. Security office
ch04.indd 274
10/5/2007 11:49:14 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
275 C. Security policy D. Owner 19. Which could be considered a single point of failure within a single sign-on implementation? A. Authentication server B. User’s workstation C. Logon credentials D. RADIUS 20. What role does biometrics play in access control? A. Authorization B. Authenticity C. Authentication D. Accountability 21. What determines if an organization is going to operate under a discretionary, mandatory, or nondiscretionary access control model? A. Administrator B. Security policy C. Culture D. Security levels 22. What type of attack attempts all possible solutions? A. Dictionary B. Brute force C. Man-in-the-middle D. Spoofing 23. Spoofing can be described as which of the following? A. Eavesdropping on a communication link B. Working through a list of words C. Session hijacking D. Pretending to be someone or something else 24. Which of the following is not an advantage of a centralized access control administration? A. Flexibility B. Standardization C. A higher level of security D. No need for different interpretations of a necessary security level
ch04.indd 275
10/5/2007 11:49:14 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
276 25. Which of the following best describes what role-based access control offers companies in reducing administrative burdens? A. It allows entities closer to the resources to make decisions about who can and cannot access resources. B. It provides a centralized approach for access control, which frees up department managers. C. User membership in roles can be easily revoked and new ones established as job assignments dictate. D. It enforces enterprise-wide security policies, standards, and guidelines.
Answers 1. D. Compared to the other available authentication mechanisms, biometric methods provide the highest level of protection and are the most expensive. 2. B. Most systems do not use the actual passphrase or password the user enters. Instead, they put this value through some type of encryption or hashing function to come up with another format of that value, referred to as a virtual password. 3. C. Passwords provide the least amount of protection, but are the cheapest because they do not require extra readers (as with smart cards and memory cards), do not require devices (as do biometrics), and do not require a lot of overhead in processing (as in cryptography). Passwords are the most common type of authentication method used today. 4. A. Separation of duties is put into place to ensure one entity cannot carry out a task that could be damaging or risky to the company. It requires two or more people to come together to do their individual tasks to accomplish the overall task. If a person wanted to commit fraud and separation of duties was in place, they would need to participate in collusion. 5. C. A logical control is the same thing as a technical control. All of the answers were logical in nature except an ID badge. Badges are used for physical security and are considered physical controls. 6. D. The best approach to security is to try to prevent bad things from occurring by putting the necessary controls and mechanisms in place. Detective controls should also be implemented, but a security model should not work from a purely detective approach. 7. B. Roles work as containers for users. The administrator or security professional creates the roles and assigns rights to them and then assigns users to the container. The users then inherit the permissions and rights from the containers (roles), which is how implicit permissions are obtained. 8. B. An asynchronous token device is based on challenge/response mechanisms. The authentication service sends the user a challenge value, which the user
ch04.indd 276
10/5/2007 11:49:14 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 4: Access Control
277 enters into the token. The token encrypts or hashes this value, and the user uses this as her one-time password. 9. D. The DAC model allows users, or data owners, the discretion of letting other users access their resources. DAC is implemented by ACLs, which the data owner can configure. 10. D. This is considered a strong authentication approach because it is twofactor—it uses two out of the possible three authentication techniques (something a person knows, is, or has). 11. A. Message authentication code (MAC) is a cryptographic function and is not a key component of Kerberos. Kerberos is made up of a KDC, a realm of principals (users, services, applications, and devices), an authentication service, tickets, and a ticket granting service. 12. D. DAC is implemented and enforced through the use of access control lists (ACLs), which are held in a matrix. MAC is implemented and enforced through the use of security labels. 13. C. Authentication means to validate the identity of a user. In most systems, the user must submit some type of public information (username, account number) and a second credential to prove this identity. The second piece of the credential set is private and should not be shared. 14. A. It is easier on the administrator if she only has to create one role, assign all of the necessary rights and permissions to that role, and plug a user into that role when needed. Otherwise, she would need to assign and extract permissions and rights on all systems as each individual came and left the company. 15. C. As stated in a previous question, passwords are the most common authentication mechanism used today. They are used to validate a user’s identity. 16. A. Mutual authentication means it is happening in both directions. Instead of just the user having to authenticate to the server, the server also must authenticate to the user. 17. B. Reviewing audit logs takes place after the fact, after some type of incident happens. It is detective in nature because the security professional is trying to figure out what exactly happened, how to correct it, and possibly who is responsible. 18. D. This question may seem a little confusing if you were stuck between user and owner. Only the data owner can decide who can access the resources she owns. She may be a user and she may not. A user is not necessarily the owner of the resource. Only the actual owner of the resource can dictate what subjects can actually access the resource. 19. A. In a single sign-on technology, all users are authenticating to one source. If that source goes down, authentication requests cannot be processed. 20. C. Biometrics is a technology that validates an individual’s identity by reading a physical attribute. In some cases, biometrics can be used for identification, but that was not listed as an answer choice.
ch04.indd 277
10/5/2007 11:49:14 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
278 21. B. The security policy sets the tone for the whole security program. It dictates the level of risk that management and the company are willing to accept. This in turn dictates the type of controls and mechanisms to put in place to ensure this level of risk is not exceeded. 22. B. A brute force attack tries a combination of values in an attempt to discover the correct sequence that represents the captured password or whatever the goal of the task is. It is an exhaustive attack, meaning the attacker will try over and over again until she is successful. 23. D. Spoofing is the process of pretending to be another person or process with the goal of obtaining unauthorized access. Spoofing is usually done by using a bogus IP address, but it could be done by using someone else’s authentication credentials. 24. A. A centralized approach does not provide as much flexibility as decentralized access control administration, because one entity is making all the decisions instead of several entities that are closer to the resources. A centralized approach is more structured in nature, which means there is less flexibility. 25. C. An administrator does not need to revoke and reassign permissions to individual users as they change jobs. Instead, the administrator assigns permissions and rights to a role, and users are plugged into those roles.
ch04.indd 278
10/5/2007 11:49:15 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CHAPTER
Security Architecture and Design
5
This chapter presents the following: • Computer hardware architecture • Operating system architectures • Trusted computing base and security mechanisms • Protection mechanisms within an operating system • Various security models • Assurance evaluation criteria and ratings • Certification and accreditation processes • Attack types
Computer and information security covers many areas within an enterprise. Each area has security vulnerabilities and, hopefully, some corresponding countermeasures that raise the security level and provide better protection. Not understanding the different areas and security levels of network devices, operating systems, hardware, protocols, and applications can cause security vulnerabilities that can affect the environment as a whole. Two fundamental concepts in computer and information security are the security policy and security model. A security policy is a statement that outlines how entities access each other, what operations different entities can carry out, what level of protection is required for a system or software product, and what actions should be taken when these requirements are not met. The policy outlines the expectations that the hardware and software must meet to be considered in compliance. A security model outlines the requirements necessary to properly support and implement a certain security policy. If a security policy dictates that all users must be identified, authenticated, and authorized before accessing network resources, the security model might lay out an access control matrix that should be constructed so it fulfills the requirements of the security policy. If a security policy states that no one from a lower security level should be able to view or modify information at a higher security level, the supporting security model will outline the necessary logic and rules that need to be implemented to ensure that under no circumstances can a lower-level subject access a higher-level object in an unauthorized
279
ch05.indd 279
10/5/2007 11:51:43 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
280 manner. A security model provides a deeper explanation of how a computer operating system should be developed to properly support a specific security policy. NOTE Individual systems and devices can have their own security policies. These are not the organizational security policies that contain management’s directives. The systems’ security policies, and the models they use, should enforce the higher-level organizational security policy that is in place. A system policy dictates the level of security that should be provided by the individual device or operating system. Computer security can be a slippery term because it means different things to different people. Many aspects of a system can be secured, and security can happen at various levels and to varying degrees. As stated in previous chapters, information security consists of the following main attributes: • Availability Prevention of loss of, or loss of access to, data and resources • Integrity Prevention of unauthorized modification of data and resources • Confidentiality Prevention of unauthorized disclosure of data and resources These main attributes branch off into more granular security attributes, such as authenticity, accountability, nonrepudiation, and dependability. How does a company know which of these it needs, to what degree they are needed, and whether the operating systems and applications they use actually provide these features and protection? These questions get much more complex as one looks deeper into the questions and products themselves. Companies are not just concerned about e-mail messages being encrypted as they pass through the Internet. They are also concerned about the confidential data stored in their databases, the security of their web farms that are connected directly to the Internet, the integrity of data-entry values going into applications that process business-oriented information, internal users sharing trade secrets, external attackers bringing down servers and affecting productivity, viruses spreading, the internal consistency of data warehouses, and much more. These issues not only affect productivity and profitability, but also raise legal and liability issues with regard to securing data. Companies, and the management that runs them, can be held accountable if any one of the many issues previously mentioned goes wrong. So it is, or at least it should be, very important for companies to know what security they need and how to be properly assured that the protection is actually being provided by the products they purchase. Many of these security issues must be thought through before and during the design and architectural phase for a product. Security is best if it is designed and built into the foundation of operating systems and applications and not added as an afterthought. Once security is integrated as an important part of the design, it has to be engineered, implemented, tested, audited, evaluated, certified, and accredited. The security that a product provides must be rated on the availability, integrity, and confidentiality it claims to provide. Consumers then use these ratings to determine if specific products
ch05.indd 280
10/5/2007 11:51:56 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
281 provide the level of security they require. This is a long road, with many entities involved with different responsibilities. This chapter takes you from the steps that are necessary before actually developing an operating system to how these systems are evaluated and rated by governments and other agencies, and what these ratings actually mean. However, before we dive into these concepts, it is important to understand how the basic elements of a computer system work. These elements are the pieces that make up any computer’s architecture.
Computer Architecture Put the processor over there by the plant, the memory by the window, and the secondary storage upstairs. Computer architecture encompasses all of the parts of a computer system that are necessary for it to function, including the operating system, memory chips, logic circuits, storage devices, input and output devices, security components, buses, and networking components. The interrelationships and internal working of all of these parts can be quite complex, and making them work together in a secure fashion consists of complicated methods and mechanisms. Thank goodness for the smart people who figured this stuff out! Now it is up to us to learn how they did it and why. The more you understand how these different pieces work and process data, the more you will understand how vulnerabilities actually occur and how countermeasures work to impede and hinder vulnerabilities from being introduced, found, and exploited. NOTE This chapter interweaves the hardware and operating system architectures and their components to show you how they work together.
The Central Processing Unit The CPU seems complex. How does it work? Response: Black magic. It uses eye of bat, tongue of goat, and some transistors. The central processing unit (CPU) is the brain of a computer. In the most general description possible, it fetches instructions from memory and executes them. Although a CPU is a piece of hardware, it has its own instruction sets (provided by the operating system) that are necessary to carry out its tasks. Each CPU type has a specific architecture and set of instructions that it can carry out. The operating system must be designed to work within this CPU architecture. This is why one operating system may work on a Pentium processor but not on a SPARC processor. NOTE Scalable Processor Architecture (SPARC) is a type of Reduced Instruction Set Computing (RISC) chip developed by Sun Microsystems. SunOS, Solaris, and some Unix operating systems have been developed to work on this type of processor.
ch05.indd 281
10/5/2007 11:51:57 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
282 The chips within the CPU cover only a couple of square inches, but contain over 40 million transistors. All operations within the CPU are performed by electrical signals at different voltages in different combinations, and each transistor holds this voltage, which represents 0s and 1s to the computer. The CPU contains registers that point to memory locations that contain the next instructions to be executed and that enable the CPU to keep status information of the data that need to be processed. A register is a temporary storage location. Accessing memory to get information on what instructions and data must be executed is a much slower process than accessing a register, which is a component of the CPU itself. So when the CPU is done with one task, it asks the registers, “Okay, what do I have to do now?” And the registers hold the information that tells the CPU what its next job is. The actual execution of the instructions is done by the arithmetic logic unit (ALU). The ALU performs mathematical functions and logical operations on data. The ALU can be thought of as the brain of the CPU, and the CPU as the brain of the computer.
Software holds its instructions and data in memory. When action needs to take place on the data, the instructions and data memory addresses are passed to the CPU registers, as shown in Figure 5-1. When the control unit indicates that the CPU can process them, the instructions and data memory addresses are passed to the CPU for actual processing, number crunching, and data manipulation. The results are sent back to the requesting process’s memory address. An operating system and applications are really just made up of lines and lines of instructions. These instructions contain empty variables, which are populated at run time. The empty variables hold the actual data. There is a difference between instructions and data. The instructions have been written to carry out some type of functionality on the data. For example, let’s say you open a Calculator application. In reality, this program is just lines of instructions that allow you to carry out addition, subtraction, division, and other types of mathematical functions that will be executed on the data you provide. So, you type in 3 + 5. The 3 and the 5 are the data values. Once you click the = button, the Calculator program tells the CPU it needs to take the instructions on how to carry out addition and apply these instructions to the two data values 3 and 5. The ALU carries out this instruction and returns the result of 8 to the requesting program. This is
ch05.indd 282
10/5/2007 11:51:57 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
283
Figure 5-1 Instruction and data addresses are passed to the CPU for processing.
when you see the value 8 in the Calculator’s field. To users, it seems as though the Calculator program is doing all of this on its own, but it is incapable of this. It depends upon the CPU and other components of the system to carry out this type of activity. The control unit manages and synchronizes the system while different applications’ code and operating system instructions are being executed. The control unit is the component that fetches the code, interprets the code, and oversees the execution of the different instruction sets. It determines what application instructions get processed and in what priority and time slice. It controls when instructions are executed, and this execution enables applications to process data. The control unit does not actually process the data. It is like the traffic cop telling traffic when to stop and start again, as illustrated in Figure 5-2. The CPU’s time has to be sliced up into individual units and assigned to processes. It is this time slicing that fools the applications and users into thinking the system is actually carrying out several different functions at one time. While the operating system can carry out several different functions at one time (multitasking), in reality the CPU is executing the instructions in a serial fashion (one at a time). A CPU has several different types of registers, containing information about the instruction set and data that must be executed. General registers are used to hold variables and temporary results as the ALU works through its execution steps. The general registers are like the ALU’s scratch pad, which it uses while working. Special registers (dedicated registers) hold information such as the program counter, stack pointer, and program status word (PSW). The program counter register contains the memory address of the next instruction to be fetched. After that instruction is executed, the program counter is updated with the memory address of the next instruction set to be processed. It is similar to a boss and secretary relationship. The secretary keeps the boss on schedule and points her (the boss) to the necessary tasks she must carry out. This allows the
ch05.indd 283
10/5/2007 11:51:57 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
284
Figure 5-2 The control unit works as a traffic cop, indicating when instructions are sent to the processor.
boss to just concentrate on carrying out the tasks instead of having to worry about the “busy work” being done in the background. Before we get into what a stack pointer is, we must first know what a stack is. Each process has its own stack, which is a memory segment the process can read from and write to. Let’s say you and I need to communicate through a stack. What I do is put all of the things I need to say to you in a stack of papers. The first paper tells you how you can respond to me when you need to, which is called a return pointer. The next paper has some instructions I need you to carry out. The next piece of paper has the data you must use when carrying out these instructions. So, I write down on individual pieces of paper all that I need you to do for me and stack them up. When I am done, I tell you to read my stack of papers. You take the first page off the stack and carry out the request. Then you take the second page and carry out that request. You continue to do this until you are at the bottom of the stack, which contains my return pointer. You look at this return pointer (which is my memory address) to know where to send the results of all the instructions I asked you to carry out. This is how processes communicate to other processes and to the CPU. One process stacks up its information that it needs to communicate to the CPU. The CPU has to keep track of where it is in the stack, which is the purpose of the stack pointer. Once the first item on the stack is executed, then the stack pointer moves down to tell the CPU where the next piece of data is located. NOTE The traditional way of explaining how a stack works is to use the analogy of stacking up trays in a cafeteria. When people are done eating, they place their trays on a stack of other trays, and when the cafeteria employees need to get the trays for cleaning, they take the last tray placed on top and work down the stack. This analogy is used to explain how a stack works in the mode of “last in, first off.” The process being communicated to takes the last piece of data the requesting process laid down from the top of the stack and works down the stack.
ch05.indd 284
10/5/2007 11:51:58 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
285 The program status word (PSW) holds different condition bits. One of the bits indicates whether the CPU should be working in user mode (also called problem state) or privileged mode (also called kernel or supervisor mode). The crux of this chapter is to teach you how operating systems protect themselves. They need to protect themselves from applications, utilities, and user activities if they are going to provide a stable and safe environment. One of these protection mechanisms is implemented through the use of these different execution modes. When an application needs the CPU to carry out its instructions, the CPU works in user mode. This mode has a lower privilege level and many of the CPU’s instructions and functions are not available to the requesting application. The reason for the extra caution is that the developers of the operating system do not know who developed the application or how it is going to react, so the CPU works in a lower privileged mode when executing these types of instructions. By analogy, if you are expecting visitors who are bringing their two-year-old boy, you move all of the breakables that someone under three feet can reach. No one is ever sure what a two-year-old toddler is going to do, but it usually has to do with breaking something. An operating system and CPU are not sure what applications are going to attempt, which is why this code is executed in a lower privilege. If the PSW has a bit value that indicates the instructions to be executed should be carried out in privileged mode, this means a trusted process (an operating system process) made the request and can have access to the functionality that is not available in user mode. An example would be if the operating system needed to communicate with a peripheral device. This is a privileged activity that applications cannot carry out. When these types of instructions are passed to the CPU, the PSW is basically telling the CPU, “The process that made this request is an all right guy. We can trust him. Go ahead and carry out this task for him.” Memory addresses of the instructions and data to be processed are held in registers until needed by the CPU. The CPU is connected to an address bus, which is a hardwired connection to the RAM chips in the system and the individual input/output (I/O) devices. Memory is cut up into sections that have individual addresses associated with them. I/O devices (CD-ROM, USB device, hard drive, floppy drive, and so on) are also allocated specific unique addresses. If the CPU needs to access some data, either from memory or from an I/O device, it sends down the address of where the needed data are located. The circuitry associated with the memory or I/O device recognizes the address the CPU sent down the address bus and instructs the memory or device to read the requested data and put it on the data bus. So the address bus is used by the CPU to indicate the location of the instructions to be processed, and the memory or I/O device responds by sending the data that reside at that memory location through the data bus. This process is illustrated in Figure 5-3. Once the CPU is done with its computation, it needs to return the results to the requesting program’s memory. So, the CPU sends the requesting program’s address down the address bus and sends the new results down the data bus with the command write. These new data are then written to the requesting program’s memory space. The address and data buses can be 8, 16, 32, or 64 bits wide. Most systems today use a 32-bit address bus, which means the system can have a large address space (232). Systems can also have a 32-bit data bus, which means the system can move data in parallel
ch05.indd 285
10/5/2007 11:51:58 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
286 Figure 5-3 Address and data buses are separate and have specific functionality.
back and forth between memory, I/O devices, and the CPU. (A 32-bit data bus means the size of the chunks of data a CPU can request at a time is 32 bits.)
Multiprocessing Some specialized computers have more than one CPU, for increased performance. An operating system must be developed specifically to be able to understand and work with more than one processor. If the computer system is configured to work in symmetric mode, this means the processors are handed work as needed as shown with CPU 1 and CPU 2 in Figure 5-4. It is like a load-balancing environment. When a process needs instructions to be executed, a scheduler determines which processor is ready for more work and sends it on. If a processor is going to be dedicated for a specific task or application, all other software would run on a different processor. In Figure 5-4, CPU 4 is dedicated to one application and its threads, while CPU 3 is used by the operating system. When a processor is dedicated as in this example, the system is working in asymmetric mode. This usually means the computer has some type of time-sensitive application that needs its own personal processor. So, the system scheduler will send instructions from the time-sensitive application to CPU 4 and send all the other instructions (from the operating system and other applications) to CPU 3. The differences are shown in Figure 5-4.
ch05.indd 286
10/5/2007 11:51:58 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
287
Figure 5-4 Symmetric mode and asymmetric mode
Operating System Architecture An operating system provides an environment for applications and users to work within. Every operating system is a complex beast, made up of various layers and modules of functionality. It has the responsibility of managing the hardware components, memory management, I/O operations, file system, process management, and providing system services. We next look at each of these responsibilities in every operating system. However, you must realize that whole books are written on just these individual topics, so the discussion here will only be topical.
Process Management Well just look at all of these processes squirming around like little worms. We need some real organization here! Operating systems, utilities, and applications in reality are just lines and lines of instructions. They are static lines of code that are brought to life when they are initialized and put into memory. Applications work as individual units, called processes, and the operating system has several different processes carrying out various types of functionality. A process is the set of instructions that is actually running. A program is not considered a process until it is loaded into memory and activated by the operating
ch05.indd 287
10/5/2007 11:51:59 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
288 Processor Evolution The following table provides the different characteristics of the various processors used over the years. Name
Date
Transistors
Microns
Clock Speed
Data Width
MIPS
8080
1974
6000
6
2MHz
8 bits
0.64
80286
1982
134,000
1.5
6MHz
16 bits
1
Pentium
1993
3,100,000
0.8
60MHz
32 bits, 64-bit bus
100
Pentium 4
2000
42,000,000
0.18
1.5GHz
32 bits, 64-bit bus
1700
The following list defines the terms of measure used in the preceding table: • Microns Indicates the width of the smallest wire on the CPU chip (a human hair is 100 microns thick). • Clock speed Indicates the speed at which the processor can execute instructions. An internal clock is used to regulate the rate of execution, which is broken down into cycles. A system that runs at 100MHz means there are 100 million clock cycles per second. Processors working at 4GHz are now available, which means the CPU can execute 4 thousand million cycles per second. • Data width Indicates the amount of data the ALU can accept and process; 64-bit bus refers to the size of the data bus. So, modern systems fetch 64 bits of data at a time, but the ALU works only on instruction sets in 32-bit sizes. • MIPS Millions of instructions per second, which is a basic indication of how fast a CPU can work (but other factors are involved, such as clock speed).
system. When a process is created, the operating system assigns resources to it, such as a memory segment, CPU time slot (interrupt), access to system application programming interfaces (APIs), and files to interact with. The collection of the instructions and the assigned resources is referred to as a process. The operating system has many processes, which are used to provide and maintain the environment for applications and users to work within. Some examples of the functionality that individual processes provide include displaying data onscreen, spooling print jobs, and saving data to temporary files. Today’s operating systems provide multiprogramming, which means that more than one program (or process) can be loaded into memory at the same time. This is what allows you to run your antivirus software, word processor, personal firewall, and e-mail client all at the same time. Each of these applications runs as one or more processes.
ch05.indd 288
10/5/2007 11:51:59 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
289 NOTE Many resources state that today’s operating systems provide multiprogramming and multitasking. This is true, in that multiprogramming just means more than one application can be loaded into memory at the same time. But in reality, multiprogramming was replaced by multitasking, which means more than one application can be in memory at the same time and the operating system can deal with requests from these different applications simultaneously. Earlier operating systems wasted their most precious resource—CPU time. For example, when a word processor would request to open a file on a floppy drive, the CPU would send the request to the floppy drive and then wait for the floppy drive to initialize, for the head to find the right track and sector, and finally for the floppy drive to send the data via the data bus to the CPU for processing. To avoid this waste of CPU time, multitasking was developed, which enabled more than one program to be loaded into memory at one time. Instead of sitting idle waiting for activity from one process, the CPU could execute instructions for other processes, thereby speeding up the necessary processing required for all the different processes. As an analogy, if you (CPU) put bread in a toaster (process) and just stand there waiting for the toaster to finish its job, you are wasting time. On the other hand, if you put bread in the toaster and then, while it’s toasting, feed the dog, make coffee, and come up with a solution for world peace, you are being more productive and not wasting time. Operating systems started out as cooperative and then evolved into preemptive multitasking. Cooperative multitasking, used in Windows 3.1 and early Macintosh systems, required the processes to voluntarily release resources they were using. This was not necessarily a stable environment, because if a programmer did not write his code properly to release a resource when his application was done using it, the resource would be committed indefinitely to his application and thus be unavailable to other processes. With preemptive multitasking, used in Windows 9x, NT, 2000, XP, and in Unix systems, the operating system controls how long a process can use a resource. The system can suspend a process that is using the CPU and allow another process access to it through the use of time sharing. So, in operating systems that used cooperative multitasking, the processes had too much control over resource release, and when an application hung, it usually affected all the other applications and sometimes the operating system itself. Operating systems that use preemptive multitasking run the show, and one application does not negatively affect another application as easily. Different operating system types work within different process models. For example, Unix and Linux systems allow their processes to create new children processes, which is referred to as forking. Let’s say you are working within a shell of a Linux system. That shell is the command interpreter and an interface that enables the user to interact with the operating system. The shell runs as a process. When you type in a shell the command cat file1 file2 | grep stuff, you are telling the operating system to concatenate (cat) the two files and then search (grep) for the lines that have the value of stuff in them. When you press the ENTER key, the shell forks two children processes—one for the cat command and one for the grep command. Each of these children processes takes on the characteristics of the parent process, but has its own memory space, stack, and program counter values.
ch05.indd 289
10/5/2007 11:51:59 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
290 A process can run in running state (CPU is executing its instructions and data), ready state (waiting to send instructions to the CPU), or blocked state (waiting for input data, such as keystrokes from a user). These different states are illustrated in Figure 5-5. When a process is blocked, it is waiting for some type of data to be sent to it. In the preceding example of typing the command cat file1 file2 | grep stuff, the grep process cannot actually carry out its functionality of searching until the first process (cat) is done combining the two files. The grep process will put itself to sleep and will be in the blocked state until the cat process is done and sends the grep process the input it needs to work with. NOTE Not all operating systems create and work in the process hierarchy like Unix and Linux systems. Windows systems do not fork new children processes, but instead create new threads that work within the same context of the parent process. This is deeper than what you need to know for the CISSP exam, but life is not just about this exam—right? The operating system is responsible for creating new processes, assigning them resources, synchronizing their communication, and making sure nothing insecure is taking place. The operating system keeps a process table, which has one entry per process. The table contains each individual process’s state, stack pointer, memory allocation, program counter, and status of open files in use. The reason the operating system documents all of this status information is that the CPU needs all of it loaded into its registers when it needs to interact with, for example, process 1. When process 1’s CPU time slice is over, all of the current status information on process 1 is stored in the process table so that when its time slice is open again, all of this status information can be put back into the CPU registers. So, when it is process 2’s time with the CPU, its status information is transferred from the process table to the CPU registers, and transferred back again when the time slice is over. These steps are shown in Figure 5-6. How does a process know when it can communicate with the CPU? This is taken care of by using interrupts. An operating system fools us, and applications, into thinking it and the CPU are carrying out all tasks (operating system, applications, memory, I/O, and user activities) simultaneously. In fact, this is impossible. Most CPUs can do only one thing at a time. So the system has hardware and software interrupts. When a
Figure 5-5 Processes enter and exit different states.
ch05.indd 290
10/5/2007 11:52:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
291
Figure 5-6 A process table contains process status data that the CPU requires.
device needs to communicate with the CPU, it has to wait for its interrupt to be called upon. The same thing happens in software. Each process has an interrupt assigned to it. It is like pulling a number at a customer service department in a store. You can’t go up to the counter until your number has been called out. When a process is interacting with the CPU and an interrupt takes place (another process has requested access to the CPU), the current process’s information is stored in the process table, and the next process gets its time to interact with the CPU. NOTE Some critical processes cannot afford to have their functionality interrupted by another process. The operating system is responsible for setting the priorities for the different processes. When one process needs to interrupt another process, the operating system compares the priority levels of the two processes to determine if this interruption should be allowed. There are two categories of interrupts: maskable and non-maskable. A maskable interrupt is assigned to an event that may not be overly important and the programmer can indicate that if that interrupt calls, the program does not stop what it is doing. This
ch05.indd 291
10/5/2007 11:52:00 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
292 means the interrupt is ignored. Non-maskable interrupts can never be overridden by an application because the event that has this type of interrupt assigned to it is critical. As an example, the reset button would be assigned a non-maskable interrupt. This means that when this button is pushed, the CPU carries out its instructions right away. As an analogy, a boss can tell her administrative assistant she is not going to take any calls unless the Pope or Elvis phones. This means all other people will be ignored or masked (maskable interrupt), but the Pope and Elvis will not be ignored (non-maskable interrupt). This is probably a good policy. You should always accept calls from either the Pope or Elvis. Just remember not to use any bad words when talking to the Pope. The watchdog timer is an example of a critical process that must always do its thing. This process will reset the system with a warm boot if the operating system hangs and cannot recover itself. For example, if there is a memory management problem and the operating system hangs, the watchdog timer will reset the system. This is one mechanism that ensures the software provides more of a stable environment.
Thread Management What are all of these hair-like things hanging off of my processes? Response: Threads. As described earlier, a process is a program in memory. More precisely, a process is the program’s instructions and all the resources assigned to the process by the operating system. It is just easier to group all of these instructions and resources together and control it as one entity, which is a process. When a process needs to send something to the CPU for processing, it generates a thread. A thread is made up of an individual instruction set and the data that must be worked on by the CPU.
ch05.indd 292
10/5/2007 11:52:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
293 Most applications have several different functions. Word processors can open files, save files, open other programs (such as an e-mail client), and print documents. Each one of these functions requires a thread (instruction set) to be dynamically generated. So, for example, if Tom chooses to print his document, the word processor process generates a thread that contains the instructions of how this document should be printed (font, colors, text, margins, and so on). If he chooses to send a document via e-mail through this program, another thread is created that tells the e-mail client to open and what file needs to be sent. Threads are dynamically created and destroyed as needed. Once Tom is done printing his document, the thread that was generated for this functionality is destroyed. A program that has been developed to carry out several different tasks at one time (display, print, interact with other programs) is capable of running several different threads simultaneously. An application with this capability is referred to as a multithreaded application. NOTE Each thread shares the same resources of the process that created it. So, all the threads created by a word processor work in the same memory space and have access to all the same files and system resources.
Process Scheduling Scheduling and synchronizing various processes and their activities is part of process management, which is a responsibility of the operating system. Several components need to be considered during the development of an operating system, which will dictate how process scheduling will take place. A scheduling policy is created to govern how threads will interact with other threads. Different operating systems can use different schedulers, which are basically algorithms that control the timesharing of the CPU. As stated earlier, the different processes are assigned different priority levels (interrupts) that dictate which processes overrule other processes when CPU time allocation is required. The operating system creates and deletes processes as needed, and oversees them changing state (ready, blocked, running). The operating system is also responsible for controlling deadlocks between processes attempting to use the same resources.
Definitions The concepts of how computer operating systems work can be overwhelming at times. For test purposes, make sure you understand the following definitions: • Multiprogramming An operating system can load more than one program in memory at one time. • Multitasking An operating system can handle requests from several different processes loaded into memory at the same time. • Multithreading An application has the ability to run multiple threads simultaneously. • Multiprocessing The computer has more than one CPU.
ch05.indd 293
10/5/2007 11:52:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
294 When a process makes a request for a resource (memory allocation, printer, secondary storage devices, disk space, and so on), the operating system creates certain data structures and dedicates the necessary processes for the activity to be completed. Once the action takes place (a document is printed, a file is saved, or data are retrieved from the drive), the process needs to tear down these built structures and release the resources back to the resource pool so they are available for other processes. If this does not happen properly, a deadlock situation may occur or a computer may not have enough resources to process other requests (resulting in a denial of service). A deadlock situation may occur when each process in a set of processes is waiting for an event to take place and that event can only be caused by another process in the set. Because each process is waiting for its required event, none of the processes will carry out their events—so the processes just sit there staring at each other. One example of a deadlock situation is when process A commits resource 1 and needs to use resource 2 to properly complete its task, but process B has committed resource 2 and needs resource 1 to finish its job. So both processes are in deadlock because they do not have the resources they need to finish the function they are trying to carry out. This situation does not take place as often as it used to, as a result of better programming. Also, operating systems now have the intelligence to detect this activity and either release committed resources or control the allocation of resources so they are properly shared between processes. Operating systems have different methods of dealing with resource requests and releases and solving deadlock situations. In some systems, if a requested resource is unavailable for a certain period of time, the operating system kills the process that is “holding on to” that resource. This action releases the resource from the process that had committed it and restarts the process so it is “clean” and available for use by other applications. Other operating systems might require a program to request all the resources it needs before it actually starts executing instructions, or require a program to release its currently committed resources before it may acquire more.
Process Activity Process 1, go into your room and play with your toys. Process 2, go into your room and play with your toys. No intermingling and no fighting! Computers can run different applications and processes at the same time. The processes have to share resources and play nice with each other to ensure a stable and safe computing environment that maintains its integrity. Some memory, data files, and variables are actually shared between different processes. It is critical that more than one process does not attempt to read and write to these items at the same time. The operating system is the master program that prevents this type of action from taking place and ensures that programs do not corrupt each other’s data held in memory. The operating system works with the CPU to provide time slicing through the use of interrupts to ensure that processes are provided with adequate access to the CPU. This also makes certain that critical system functions are not negatively affected by rogue applications. To protect processes from each other, operating systems can implement process isolation. Process isolation is necessary to ensure that processes do not “step on each other’s toes,” communicate in an insecure manner, or negatively affect each other’s productivity. Older operating systems did not enforce process isolation as well as sys-
ch05.indd 294
10/5/2007 11:52:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
295 tems do today. This is why in earlier operating systems, when one of your programs hung, all other programs, and sometimes the operating system itself, hung. With process isolation, if one process hangs for some reason, it will not affect the other software running. (Process isolation is required for preemptive multitasking.) Different methods can be used to carry out process isolation: • Encapsulation of objects • Time multiplexing of shared resources • Naming distinctions • Virtual mapping When a process is encapsulated, no other process understands or interacts with its internal programming code. When process A needs to communicate with process B, process A just needs to know how to communicate with process B’s interface. An interface defines how communication must take place between two processes. As an analogy, think back to how you had to communicate with your third-grade teacher. You had to call her Mrs. So-and-So, say please and thank you, and speak respectfully to get whatever it was you needed. The same thing is true for software components that need to communicate with each other. They must know how to communicate properly with each other’s interfaces. The interfaces dictate the type of requests a process will accept and the type of output that will be provided. So, two processes can communicate with each other, even if they are written in different programming languages, as long as they know how to communicate with each other’s interface. Encapsulation provides data hiding, which means that outside software components will not know how a process works and will not be able to manipulate the process’s internal code. This is an integrity mechanism and enforces modularity in programming code. Time multiplexing was already discussed, although we did not use this term. Time multiplexing is a technology that allows processes to use the same resources. As stated earlier, a CPU must be shared between many processes. Although it seems as though all applications are running (executing their instructions) simultaneously, the operating system is splitting up time shares between each process. Multiplexing means there are several data sources and the individual data pieces are piped into one communication channel. In this instance, the operating system is coordinating the different requests from the different processes and piping them through the one shared CPU. An operating system must provide proper time multiplexing (resource sharing) to ensure a stable working environment exists for software and users. Naming distinctions just means that the different processes have their own name or identification value. Processes are usually assigned process identification (PID) values, which the operating system and other processes use to call upon them. If each process is isolated, that means each process has its own unique PID value. Virtual mapping is different from the physical mapping of memory. An application is written such that basically it thinks it is the only program running on an operating system. When an application needs memory to work with, it tells the operating system’s memory manager how much memory it needs. The operating system carves out that amount of memory and assigns it to the requesting application. The application uses its own address scheme, which usually starts at 0, but in reality, the application does
ch05.indd 295
10/5/2007 11:52:01 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
296 not work in the physical address space it thinks it is working in. Rather, it works in the address space the memory manager assigns to it. The physical memory is the RAM chips in the system. The operating system chops up this memory and assigns portions of it to the requesting processes. Once the process is assigned its own memory space, it can address this portion however it wishes, which is called virtual address mapping. Virtual address mapping allows the different processes to have their own memory space; the memory manager ensures no processes improperly interact with another process’s memory. This provides integrity and confidentiality.
Memory Management To provide a safe and stable environment, an operating system must exercise proper memory management—one of its most important tasks. After all, everything happens in memory. It’s similar to how we depend on oxygen and gravity for our existence. If either slides out of balance, we’re in big trouble. The goals of memory management are to: • Provide an abstraction level for programmers • Maximize performance with the limited amount of memory available • Protect the operating system and applications loaded into memory Abstraction means that the details of something are hidden. Developers of applications do not know the amount or type of memory that will be available in each and every system their code will be loaded on. If a developer had to be concerned with this type of detail, then her application would be able to work only on the one system that maps to all of her specifications. To allow for portability, the memory manager hides all of the memory issues and just provides the application with a memory segment. Every computer has a memory hierarchy. Certain small amounts of memory are very fast and expensive (registers, cache), while larger amounts are slower and less expensive (RAM, hard drive). The portion of the operating system that keeps track of how these different types of memory are used is lovingly called the memory manager. Its jobs are to allocate and deallocate different memory segments, enforce access control to ensure processes are interacting only with their own memory segments, and swap memory contents from RAM to the hard drive.
ch05.indd 296
10/5/2007 11:52:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
297 The memory manager has five basic responsibilities: Relocation • Swap contents from RAM to the hard drive as needed (explained later in the “Virtual Memory” section of this chapter) • Provide pointers for applications if their instructions and memory segment have been moved to a different location in main memory Protection • Limit processes to interact only with the memory segments assigned to them • Provide access control to memory segments Sharing • Use complex controls to ensure integrity and confidentiality when processes need to use the same shared memory segments • Allow many users with different levels of access to interact with the same application running in one memory segment Logical organization • Allow for the sharing of specific software modules, such as dynamic link library (DLL) procedures Physical organization • Segment the physical memory space for application and operating system processes NOTE A dynamic link library (DLL) is a set of functions that applications can call upon to carry out different types of procedures. For example, the Windows operating system has a crypt32.dll that is used by the operating system and applications for cryptographic functions. Windows has a set of DLLs, which is just a library of functions to be called upon. How can an operating system make sure a process only interacts with its memory segment? When a process creates a thread, because it needs some instructions and data processed, the CPU uses two registers. A base register contains the beginning address that was assigned to the process, and a limit register contains the ending address, as illustrated in Figure 5-7. The thread contains an address of where the instruction and data reside that need to be processed. The CPU compares this address to the base and limit registers to make sure the thread is not trying to access a memory segment outside of its bounds. So, the base register makes it impossible for a thread to reference a memory address below its allocated memory segment, and the limit register makes it impossible for a thread to reference a memory address above this segment.
ch05.indd 297
10/5/2007 11:52:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
298 Figure 5-7 Base and limit registers are used to contain a process in its own memory segment.
Memory is also protected through the use of user and privileged modes of execution, as previously mentioned, and covered in more detail later in the “CPU Modes and Protection Rings” section of this chapter.
Memory Types The operating system instructions, applications, and data are held in memory, but so are the basic input/output system (BIOS), device controller instructions, and firmware. They do not all reside in the same memory location or even the same type of memory. The different types of memory, what they are used for, and how each is accessed can get a bit confusing because the CPU deals with several different types for different reasons.
Memory Protection Issues • Every address reference is validated for protection. • Two or more processes can share access to the same segment with potentially different access rights. • Different instruction and data types can be assigned different levels of protection. • Processes cannot generate an unpermitted address or gain access to an unpermitted segment. All of these issues make it more difficult for memory management to be carried out properly in a constantly changing and complex system. Any time more complexity is introduced, it usually means more vulnerabilities can be exploited.
ch05.indd 298
10/5/2007 11:52:02 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
299 The following sections outline the different types of memory that can be used within computer systems.
Random Access Memory Random access memory (RAM) is a type of temporary storage facility where data and program instructions can temporarily be held and altered. It is used for read/write activities by the operating system and applications. It is described as volatile because if the computer’s power supply is terminated, then all information within this type of memory is lost. RAM is an integrated circuit made up of millions of transistors and capacitors. The capacitor is where the actual charge is stored, which represents a 1 or 0 to the system. The transistor acts like a gate or a switch. A capacitor that is storing a binary value of 1 has several electrons stored in it, which have a negative charge, whereas a capacitor that is storing a 0 value is empty. When the operating system writes over a 1 bit with a 0 bit, in reality it is just emptying out the electrons from that specific capacitor. One problem is that these capacitors cannot keep their charge for long. Therefore, a memory controller has to “recharge” the values in the capacitors, which just means it continually reads and writes the same values to the capacitors. If the memory controller does not “refresh” the value of 1, the capacitor will start losing its electrons and become a 0 or a corrupted value. This explains how dynamic RAM (DRAM) works. The data being held in the RAM memory cells must be continually and dynamically refreshed so your bits do not magically disappear. This activity of constantly refreshing takes time, which is why DRAM is slower than static RAM. NOTE When we are dealing with memory activities, we use a time metric of nanoseconds (ns), which is a billionth of a second. So if you look at your RAM chip and it states 70 ns, this means it takes 70 nanoseconds to read and refresh each memory cell. Static RAM (SRAM) does not require this continuous-refreshing nonsense; it uses a different technology, by holding bits in its memory cells without the use of capacitors, but it does require more transistors than DRAM. Since SRAM does not need to be refreshed, it is faster than DRAM, but because SRAM requires more transistors, it takes up more space on the RAM chip. Manufacturers cannot fit as many SRAM memory cells on a memory chip as they can DRAM memory cells, which is why SRAM is more expensive. So, DRAM is cheaper and slower, and SRAM is more expensive and faster. It always seems to go that way. SRAM has been used in cache, and DRAM is commonly used in RAM chips.
Hardware Segmentation Systems of a higher trust level may need to implement hardware segmentation of the memory used by different processes. This means memory is separated physically instead of just logically. This adds another layer of protection to ensure that a lower-privileged process does not access and modify a higher-level process’s memory space.
ch05.indd 299
10/5/2007 11:52:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
300 Because life is not confusing enough, we have many other types of RAM. The main reason for the continual evolution of RAM types is that it directly affects the speed of the computer itself. Many people, mistakenly, think that just because you have a fast processor, your computer will be fast. However, memory type and size and bus sizes are also critical components. Think of memory as pieces of paper used by the system to hold instructions. If the system had small pieces of papers (small amount of memory) to read and write from, it would spend most of its time looking for these pieces and lining them up properly. When a computer spends more time moving data from one small portion of memory to another than actually processing the data, it is referred to as thrashing. This causes the system to crawl in speed and your frustration level to increase. The size of the data bus also makes a difference in system speed. You can think of a data bus as a highway that connects different portions of the computer. If a ton of data must go from memory to the CPU and can only travel over a four-lane highway, compared to a 64-lane highway, there will be delays in processing. So the processor, memory type and amount, and bus speeds are critical components to system performance. The following are additional types of RAM you should be familiar with: • Synchronous DRAM (SDRAM) Synchronizes itself with the system’s CPU and synchronizes signal input and output on the RAM chip. It coordinates its activities with the CPU clock so the timing of the CPU and the timing of the memory activities are synchronized. This increases the speed of transmitting and executing data. • Extended data out DRAM (EDO DRAM) Is faster than DRAM because DRAM can access only one block of data at a time, whereas EDO DRAM can capture the next block of data while the first block is being sent to the CPU for processing. It has a type of “look ahead” feature that speeds up memory access. • Burst EDO DRAM (BEDO DRAM) Works like (and builds upon) EDO DRAM in that it can transmit data to the CPU as it carries out a read option, but it can send more data at once (burst). It reads and sends up to four memory addresses in a small number of clock cycles. • Double data rate SDRAM (DDR SDRAM) Carries out read operations on the rising and falling cycles of a clock pulse. So instead of carrying out one operation per clock cycle, it carries out two and thus can deliver twice the throughput of SDRAM. Basically, it doubles the speed of memory activities, when compared to SDRAM, with a smaller number of clock cycles. Pretty groovy. NOTE These different RAM types require different controller chips to interface with them; therefore, the motherboards that these memory types are used on often are very specific in nature. Well, that’s enough about RAM for now. Let’s look at other types of memory that are used in basically every computer in the world.
Read-Only Memory Read-only memory (ROM) is a nonvolatile memory type, meaning that when a computer’s power is turned off, the data are still held within the memory chips. When data are
ch05.indd 300
10/5/2007 11:52:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
301 inserted into ROM memory chips, the data cannot be altered. Individual ROM chips are manufactured with the stored program or routines designed into it. The software that is stored within ROM is called firmware. Programmable read-only memory (PROM) is a form of ROM that can be modified after it has been manufactured. PROM can be programmed only one time because the voltage that is used to write bits into the memory cells actually burns out the fuses that connect the individual memory cells. The instructions are “burned into” PROM using a specialized PROM programmer device. Erasable and programmable read-only memory (EPROM) can be erased, modified, and upgraded. EPROM holds data that can be electrically erased or written to. To erase the data on the memory chip, you need your handy-dandy ultraviolet (UV) light device that provides just the right level of energy. The EPROM chip has a quartz window, which is where you point the UV light. Although playing with UV light devices can be fun for the whole family, we have moved on to another type of ROM technology that does not require this type of activity. To erase an EPROM chip, you must remove the chip from the computer and wave your magic UV wand, which erases all of the data on the chip—not just portions of it. So someone invented electrically erasable programmable read-only memory (EEPROM), and we all put our UV light wands away for good. EEPROM is similar to EPROM, but its data storage can be erased and modified electrically by onboard programming circuitry and signals. This activity erases only one byte at a time, which is slow. And because we are an impatient society, yet another technology was developed that is very similar, but works more quickly. Flash memory is a special type of memory that is used in digital cameras, BIOS chips, memory cards for laptops, and video game consoles. It is a solid-state technology, meaning it does not have moving parts and is used more as a type of hard drive than memory. Flash memory basically moves around different levels of voltages to indicate that a 1 or 0 must be held in a specific address. It acts as a ROM technology rather than a RAM technology. (For example, you do not lose pictures stored on your memory stick in your digital camera just because your camera loses power. RAM is volatile and ROM is nonvolatile.) When Flash memory needs to be erased and turned back to its original state, a program initiates the internal circuits to apply an electric field. The erasing function takes place in blocks or on the entire chip instead of erasing one byte at a time. Flash memory is used as a small disk drive in most implementations. Its benefits over a regular hard drive are that it is smaller, faster, and lighter. So let’s deploy Flash memory everywhere and replace our hard drives! Maybe one day. Today it is relatively expensive compared to regular hard drives.
References • Unix/Linux Internals Course and Links www.softpanorama.org/Internals • Linux Knowledge Base and Tutorial www.linux-tutorial.info/modules .php?name=Tutorial&pageid=117 • Fast, Smart RAM, Peter Wayner, Byte.com (June 1995) www.byte.com/ art/9506/sec10/art2.htm
ch05.indd 301
10/5/2007 11:52:03 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
302 Cache Memory I am going to need this later, so I will just stick it into cache for now. Cache memory is a type of memory used for high-speed writing and reading activities. When the system assumes (through its programmatic logic) that it will need to access specific information many times throughout its processing activities, it will store the information in cache memory so it is easily and quickly accessible. Data in cache can be accessed much more quickly than data stored in real memory. Therefore, any information needed by the CPU very quickly, and very often, is usually stored in cache memory, thereby improving the overall speed of the computer system. An analogy is how the brain stores information it uses often. If one of Marge’s primary functions at her job is to order parts, which requires telling vendors the company’s address, Marge stores this address information in a portion of her brain from which she can easily and quickly access it. This information is held in a type of cache. If Marge was asked to recall her third-grade teacher’s name, this information would not necessarily be held in cache memory, but in a more long-term storage facility within her noggin. The long-term storage within her brain is comparable to a system’s hard drive. It takes more time to track down and return information from a hard drive than from specialized cache memory. NOTE Different motherboards have different types of cache. Level 1 (L1) is faster than Level 2 (L2), and L2 is faster than L3. Some processors and device controllers have cache memory built into them. L1 and L2 are usually built into the processors and the controllers themselves.
Memory Mapping Okay, here is your memory, here is my memory, and here is Bob’s memory. No one use each other’s memory! Because there are different types of memory holding different types of data, a computer system does not want to let every user, process, and application access all types of memory anytime they want to. Access to memory needs to be controlled to ensure data do not get corrupted and that sensitive information is not available to unauthorized processes. This type of control takes place through memory mapping and addressing. The CPU is one of the most trusted components within a system, and can access memory directly. It uses physical addresses instead of pointers (logical addresses) to memory segments. The CPU has physical wires connecting it to the memory chips within the computer. Because physical wires connect the two types of components, physical addresses are used to represent the intersection between the wires and the transistors on a memory chip. Software does not use physical addresses; instead, it employs logical memory addresses. Accessing memory indirectly provides an access control layer between the software and the memory, which is done for protection and efficiency. Figure 5-8 illustrates how the CPU can access memory directly using physical addresses and how software must use memory indirectly through a memory mapper. Let’s look at an analogy. You would like to talk to Mr. Marshall about possibly buying some acreage in Iowa. You don’t know Mr. Marshall personally, and you do not want to give out your physical address and have him show up at your doorstep. Instead, you
ch05.indd 302
10/5/2007 11:52:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
303
Figure 5-8 The CPU and applications access memory differently.
would like to use a more abstract and controlled way of communicating, so you give Mr. Marshall your phone number so you can talk to him about the land and determine whether you want to meet him in person. The same type of thing happens in computers. When a computer runs software, it does not want to expose itself unnecessarily to software written by good and bad programmers. Computers enable software to access memory indirectly by using index tables and pointers, instead of giving them the right to access the memory directly. This is one way the computer system protects itself. When a program attempts to access memory, its access rights are verified and then instructions and commands are carried out in a way to ensure that badly written code does not affect other programs or the system itself. Applications, and their processes, can only access the memory allocated to them, as shown in Figure 5-9. This type of memory architecture provides protection and efficiency. The physical memory addresses that the CPU uses are called absolute addresses. The indexed memory addresses that software uses are referred to as logical addresses. And relative addresses are based on a known address with an offset value applied. As explained previously, an application does not “know” it is sharing memory with other applications. When the program needs a memory segment to work with, it tells the memory manager how much memory it needs. The memory manager allocates this much physical memory, which could have the physical addressing of 34,000 to 39,000, for example. But the application is not written to call upon addresses in this numbering scheme. It is most likely developed to call upon addresses starting with 0 and extending to, let’s say, 5000. So the memory manager allows the application to use its own ad-
ch05.indd 303
10/5/2007 11:52:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
304
Figure 5-9 Applications, and the processes they use, access their own memory segments only.
dressing scheme—the logical addresses. When the application makes a call to one of these “phantom” logical addresses, the memory manager must map this address to the actual physical address. (It’s like two people using their own naming scheme. When Bob asks Diane for a ball, Diane knows he really means a stapler. Don’t judge Bob and Diane, it works for them.) The mapping process is illustrated in Figure 5-10. When an application needs its instructions and data processed by the CPU, the physical addresses are loaded into the base and limit registers. When a thread indicates the instruction needs to be processed, it provides a logical address. The memory manager maps the logical address to the physical address, so the CPU knows where the instruction is located. The thread will actually be using a relative address, because the application uses the address space of 0 to 5000. When the thread indicates it needs the instruction at the memory address 3400 to be executed, the memory manager has to work from its mapping of logical address 0 to the actual physical address and then figure out the physical address for the logical address 3400. So the logical address 3400 is relative to the starting address 0. As an analogy, if I know you use a different number system than everyone else in the world, and you tell me that you need 14 cookies, I would need to know where to start in your number scheme to figure out how many cookies to really give you. So, if you inform me that in “your world” your numbering scheme starts at 5, I would map 5 to 0 and know that the offset is a value of 5. So when you tell me you want 14 cookies (the relative number), I take the offset value into consideration. I know that you start at the value 5, so I map your logical address of 14 to the physical number of 8. (But I would
ch05.indd 304
10/5/2007 11:52:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
305
Figure 5-10 The CPU uses absolute addresses, and software uses logical addresses.
not give you 8 cookies, because you made me work too hard to figure all of this out. I will just eat them myself.) So the application is working in its “own world” using its “own addresses,” and the memory manager has to map these values to reality, which means the absolute address values.
Memory Leaks Oh great, the memory leaked all over me. Does someone have a mop? When an application makes a request for a memory segment, it is allocated a specific memory amount by the operating system. When the application is done with the memory, it is supposed to tell the operating system to release the memory so it is available to other applications. This is only fair. But some applications are written poorly and do not indicate to the system that this memory is no longer in use. If this happens enough times, the operating system could become “starved” for memory, which would drastically affect the system’s performance.
ch05.indd 305
10/5/2007 11:52:04 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
306 When a memory leak is identified in the hacker world, this opens the door to new Denial-of-Service (DoS) attacks. For example, when it was uncovered that a Unix application and a specific version of a Telnet protocol contained memory leaks, hackers amplified the problem. They continually sent requests to systems with these vulnerabilities. The systems would allocate resources for these network requests, which in turn would cause more and more memory to be allocated and not returned. Eventually the systems would run out of memory and freeze. NOTE Memory leaks can be caused by operating systems, applications, and software drivers.
Two main countermeasures can protect against memory leaks: developing better code that releases memory properly, and using a garbage collector. A garbage collector is software that runs an algorithm to identify unused committed memory and then tells the operating system to mark that memory as “available.” Different types of garbage collectors work with different operating systems, programming languages, and algorithms.
Virtual Memory My RAM is overflowing! Can I use some of your hard drive space? Response: No, I don’t like you. Secondary storage is considered nonvolatile storage media and includes such things as the computer’s hard drive, floppy disks, or CD-ROMs. When RAM and secondary storage are combined, the result is virtual memory. The system uses hard drive space to extend its RAM memory space. Swap space is the reserved hard drive space used to extend RAM capabilities. Windows systems use the pagefile.sys file to reserve this space. When a system fills up its volatile memory space, it writes data from memory onto the hard drive. When a program requests access to this data, it is brought from the hard drive back into memory in specific units, called page frames. This process is called paging. Accessing data kept in pages on the hard drive takes more time than accessing data kept in memory because physical disk read/write access must take place. Internal control blocks, maintained by the operating system, keep track of what page frames are residing in RAM, and what is available “offline,” ready to be called into RAM for execution or processing, if needed. The payoff is that it seems as though the system can hold an incredible amount of information and program instructions in memory, as shown in Figure 5-11. A security issue with using virtual swap space is that when the system is shut down, or processes that were using the swap space are terminated, the pointers to the pages are reset to “available” even though the actual data written to disk is still physically there. These data could conceivably be compromised and captured. On a very secure operating system, there are routines to wipe the swap spaces after a process is done with it, before it is used again. The routines should also erase this data before a system shutdown, at which time the operating system would no longer be able to maintain any control over what happens on the hard drive surface.
ch05.indd 306
10/5/2007 11:52:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
307
Figure 5-11 Combining RAM and secondary storage to create virtual memory
NOTE If a program, file, or data are encrypted and saved on the hard drive, it will be decrypted when used by the controlling program. While these unencrypted data are sitting in RAM, the system could write out the data to the swap space on the hard drive, in their unencrypted state. Attackers have figured out how to gain access to this space in unauthorized manners.
References • “Introduction to Virtual Memory,” by Tuncay Basar, Kyung Kim, and Bill Lemley http://cs.gmu.edu/cne/itcore/virtualmemory/vmintro.html • Memory Hierarchy http://courses.ece.uiuc.edu/ece411/lectures/ LecturesSpring05/Lectures_2.07.pdf • “Virtual Memory,” by Prof. Bruce Jacob, University of Maryland at College Park (2001) www.ee.umd.edu/~blj/papers/CS-chapter.pdf • LabMice.net links to articles on memory leaks http://labmice.techtarget.com/ troubleshooting/memoryleaks.htm
ch05.indd 307
10/5/2007 11:52:05 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
308 CPU Modes and Protection Rings If I am corrupted, very bad things can happen. Response: Then you need to go into ring 0. If an operating system is going to be stable, it must be able to protect itself from its users and their applications. This requires the capability to distinguish between operations performed on behalf of the operating system itself and operations performed on behalf of the users or applications. This can be complex because the operating system software may be accessing memory segments, sending instructions to the CPU for processing, and accessing secondary storage devices at the same time. Each user application (e-mail client, antivirus program, web browser, word processor, personal firewall, and so on) may also be attempting the same types of activities at the same time. The operating system must keep track of all of these events and ensure none of them violates the system’s overall security policy. The operating system has several protection mechanisms to ensure processes do not negatively affect each other or the critical components of the system itself. One has already been mentioned: memory protection. Another security mechanism the system uses is protection rings. These rings provide strict boundaries and definitions for what the processes that work within each ring can access and what operations they can successfully execute. The processes that operate within the inner rings have more privileges than the processes operating in the outer rings, because the inner rings only permit the most trusted components and processes to operate within them. Although operating systems may vary in the number of protection rings they use, processes that execute within the inner rings are usually referred to as existing in privileged, or supervisor, mode. The processes working in the outer rings are said to execute in user mode. NOTE The actual ring architecture used by a system is dictated by the processor and the operating system. The hardware chip (processor) is constructed to provide a certain number of rings, and the operating system must be developed to also work in this ring structure. This is one reason why an operating system platform may work with an Intel chip but not an Alpha chip, for example. They have different architectures and ways to interpret instruction sets. Operating system components operate in a ring that gives them the most access to memory locations, peripheral devices, system drivers, and sensitive configuration parameters. Because this ring provides much more dangerous access to critical resources, it is the most protected. Applications usually operate in ring 3, which limits the type of memory, peripheral device, and driver access activity and is controlled through the operating system services or system calls. The different rings are illustrated in Figure 5-12. The type of commands and instructions sent to the CPU from applications in the outer rings are more restrictive in nature. If an application tries to send instructions to the CPU that fall outside its permission level, the CPU treats this violation as an exception and may show a general protection fault or exception error and attempt to shut down the offending application.
ch05.indd 308
10/5/2007 11:52:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
309 Figure 5-12 More trusted processes operate within lowernumbered rings.
Protection rings support the availability, integrity, and confidentiality requirements of multitasking operating systems. The most commonly used architecture provides four protection rings: • Ring 0 Operating system kernel • Ring 1
Remaining parts of the operating system
• Ring 2
I/O drivers and utilities
• Ring 3
Applications and user activity
These protection rings provide an intermediate layer between subjects and objects, and are used for access control when a subject tries to access an object. The ring determines the access level to sensitive system resources. The lower the number, the greater the amount of privilege given to the process that runs within that ring. Each subject and object is logically assigned a number (0 through 3) depending upon the level of trust the operating system assigns it. A subject in ring 3 cannot directly access an object in ring 1, but subjects in ring 1 can directly access an object in ring 3. Entities can only access objects within their own ring and cannot directly communicate with objects in higher rings. When an application needs access to components in rings it is not allowed to directly access, it makes a request of the operating system to perform the necessary tasks. This is handled through system calls, where the operating system executes instructions not allowed in user mode. The request is passed off to an operating system service, which works at a higher privilege level and can carry out the more sensitive tasks.
ch05.indd 309
10/5/2007 11:52:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
310 When the operating system executes instructions for processes in rings 0 and 1, it operates in supervisor mode or privileged mode. When the operating system executes instructions for applications and processes in ring 3, it operates in user mode. User mode provides a much more restrictive environment for the application to work in, which in turn protects the system from misbehaving programs. If CPU execution modes and protection rings are new to you, think of protection rings as buckets. The operating system has to work within the structure and confines provided by the CPU. The CPU provides the operating system with different buckets, labeled 0 through 3. The operating system must logically place processes into the different buckets, based upon the trust level the operating system has in those processes. Since the operating system kernel is the most trusted component, it and its processes go into bucket 0. The remaining operating system processes go into bucket 1 and all user applications go into bucket 3. NOTE Many operating systems today do not use the second protection ring very often, if at all.
So, when a process from bucket 0 needs its instructions to be executed by the CPU, the CPU checks the bucket number (ring number) and flips a bit indicating that this process can be fully trusted. This means this process can interact with all of the functionality the CPU provides to processes. Some of the most privileged activities are I/O and memory access attempts. When another process, this time from bucket 3, needs its instructions processed by the CPU, the CPU first looks at what bucket this process came from. Since this process is from bucket 3, the CPU knows the operating system has the least amount of trust in this process and therefore flips a bit that restricts the amount of functionality available to this process. The CPU dictates how many buckets (rings) there are, and the operating system will be developed to use either two or all of them.
Operating System Architecture You can’t see me and you don’t know that I exist, so you can’t talk to me. Response: Fine by me. Operating systems can be developed by using several types of architecture. The architecture is the framework that dictates how the operating system’s services and functions are placed and how they interact. This section looks at the monolithic, layered, and client/server structures. A monolithic operating system architecture is commonly referred to as “The Big Mess” because of its lack of structure. The operating system is mainly made up of various procedures that can call upon each other in a haphazard manner. In these types of systems, modules of code can call upon each other as needed. The communication between the different modules is not as structured and controlled as in a layered architecture, and data hiding is not provided. MS-DOS is an example of a monolithic operating system.
ch05.indd 310
10/5/2007 11:52:06 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
311 A layered operating system architecture separates system functionality into hierarchical layers. For example, a system that followed a layered architecture was, strangely enough, called THE. THE had five layers of functionality. Layer 0 controlled access to the processor and provided multiprogramming functionality; layer 1 carried out memory management; layer 2 provided interprocess communication; layer 3 dealt with I/O devices; and layer 4 was where the applications resided. The processes at the different layers each had interfaces to be used by processes in layers below and above them. This is different from a monolithic architecture, in which the different modules can communicate with any other module. Layered operating systems provide data hiding, which means that instructions and data (packaged up as procedures) at the various layers do not have direct access to the instructions and data at any other layers. Each procedure at each layer has access only to its own data and a set of functions that it requires to carry out its own tasks. If a procedure can access more procedures than it really needs, this opens the door for more successful compromises. For example, if an attacker is able to compromise and gain control of one procedure, and this procedure has direct access to all other procedures, the attacker could compromise a more privileged procedure and carry out more devastating activities. A monolithic operating system provides only one layer of security. In a layered system, each layer should provide its own security and access control. If one layer contains the necessary security mechanisms to make security decisions for all the other layers, then that one layer knows too much about (and has access to) too many objects at the different layers. This directly violates the data-hiding concept. Modularizing software and its code increases the assurance level of the system, because if one module is compromised, it does not mean all other modules are now vulnerable. Examples of layered operating systems are THE, VAX/VMS, Multics, and Unix (although THE and Multics are no longer in use). NOTE Do not confuse client/server operating system architecture with client/server network architecture, which is the traditional association for “client/server.” In a network, an application works in a client/server model because it provides distributed computing capabilities. The client portion of the application resides on the workstations and the server portion is usually a back-end database or server. Another approach to system design works within a client/server architecture, which means that portions of software and functionality that were previously in the monolithic kernel are now at the higher levels of the operating system. The operating system functions are divided into several different processes that run in user mode, instead of kernel mode. The goal of a client/server architecture is to move as much code as possible from having to work in kernel mode (privileged mode) so the system has a leaner kernel, referred to as the microkernel. In this model, the requesting process is referred to as the client, and the process that fulfills the request is called the server. The server processes can be file system server, memory server, I/O server, or process server. These servers are commonly called subsystems. The client is either a user process or another operating system process.
ch05.indd 311
10/5/2007 11:52:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
312 Domains Okay, here are all the marbles you can play with. We will call that your domain of resources. A domain is defined as a set of objects that a subject is able to access. This domain can be all the resources a user can access, all the files available to a program, the memory segments available to a process, or the services and processes available to an application. A subject needs to be able to access and use objects (resources) to perform tasks, and the domain defines which objects are available to the subject and which objects are untouchable and therefore unusable by the subject. NOTE Remember that a thread is a portion of a process. When the thread is generated, it shares the same domain (resources) as its process.
These domains have to be identified, separated, and strictly enforced. An operating system and CPU works in either privileged mode or user mode. The reason to even use these different modes, which are dictated by the protection ring, is to define different domains. When a process’s instructions are being executed in privileged mode, the process has a much larger domain to work with (or more resources to access); thus, it can carry out more activities. When an operating system process works in privileged mode, it can access more memory segments, transfer data from an unprotected domain to a protected domain, and directly access and communicate with hardware devices. An application that functions in user mode cannot access memory directly and has a more limited amount of resources available to it. Only a certain segment of memory is available to this application, and that segment must be accessed in an indirect and controlled fashion. A process that resides in a privileged domain needs to be able to execute its instructions and process its data with the assurance that programs in a different domain cannot negatively affect its environment. This is referred to as an execution domain. Because processes in a privileged domain have access to sensitive resources, the environment must be protected from rogue program code or unexpected activities resulting from programs in other domains. Some systems may only have distinct user and privilege areas, whereas other systems may have complex architectures that contain up to ten execution domains. An execution domain has a direct correlation to the protection ring that a subject or object is assigned to. The lower the protection ring number, the higher the privilege and the larger the domain. This concept is depicted in Figure 5-13.
Layering and Data Hiding Although, academically, there are three main types of architectures for operating systems, the terms layering and data hiding are commonly used when talking about protection mechanisms for operating systems—even ones that follow the client/server architecture, because it also uses layering and data hiding to protect itself. A layered operating system architecture mainly addresses how functionality is laid out and is available to the users and programs. It provides its functionality in a hierarchy, whereas a client/server architecture provides functionality in more of a linear fash-
ch05.indd 312
10/5/2007 11:52:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
313
Figure 5-13 The higher the level of trust, the larger the number of available resources.
ion. A request does not have to go through various layers in a client/server architecture. The request just goes to the necessary subsystem. But in terms of security, both architectures use layer and data hiding to protect the critical operating system processes from applications, and applications from other applications. It is almost too bad that we have so many terms—execution domains, protection rings, layering, data hiding, protection domains, CPU modes, and so on—because in reality they all are different ways to describe the same thing that takes place within every operating system today. When people are first learning these topics, many of these concepts seem discrete and totally unrelated. But in reality, these concepts have to work together in a very orchestrated manner for the whole operating system to work and provide the level of protection it does.
ch05.indd 313
10/5/2007 11:52:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
314 As previously discussed, the operating system and CPU work within the same architecture, which provides protection rings. A process’s protection domain (execution domain) is determined by the protection ring that it resides within. When a process needs the CPU to execute instructions, the CPU works in a specific mode (user or privileged) depending upon what protection ring the process is in. Layering and data hiding are provided by placing the different processes in different protection rings and controlling how communication takes place from the less trusted and the more trusted processes. So, layering is a way to provide buffers between the more trusted and less trusted processes. The less trusted processes cannot directly communicate with the more trusted processes, but rather must submit their requests to an operating system service. This service acts as a broker or a bouncer that makes sure nothing gains unauthorized access to the more trusted processes. This architecture protects the operating system overall, including all the applications and user activities going on within it.
The Evolution of Terminology Although academically monolithic, layered, and client/server architectures describe how an operating system is constructed, these terms have morphed to describe mainly how the kernel is built. What this means is that in the industry, and on the CISSP exam, when you see the term “monolithic system,” it is actually referring to the fact that all of the code that makes up the kernel runs in kernel (privileged mode). So the confusing piece is that there is actually an operating system framework called a monolithic framework and there is a specific term that applies only to the kernel (monolithic kernel)— but today these terms have merged. Whenever the term “monolithic system” is used today, it refers to how the kernel is built. NOTE Remember that kernel mode, privileged mode, and supervisory mode all mean the same thing.
A monolithic kernel means all of the kernel’s activity works in privileged (supervisory) mode, as illustrated in Figure 5-14. This means the operating system’s functionality (process, file, memory, I/O management, and more) work in ring 0 of the protection rings we discussed earlier. Windows NT, 2000, and Vista are all considered monolithic systems because all of their operating services execute in kernel mode. On one hand, this causes a security risk, because if one process within the kernel fails, it can affect the whole kernel. It also means that with more code running in this privilege mode, more code can be exploited by attackers, giving them a high level of control of the system. This means that creating a secure monolithic system is complex and it is more difficult to ensure security. The reason Windows operating systems (and Unix and Linux) have been developed to use a monolithic kernel is because of performance. When some kernel components run in user mode and others in kernel mode, it takes a lot longer for the CPU to carry out its execution of instructions because of the changing from user mode to kernel mode and back again. What this means is that most of the operating systems we work with today mainly use ring 0 and ring 3 of the protection ring architecture described in a previous section.
ch05.indd 314
10/5/2007 11:52:07 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
315
Figure 5-14 Subsystems fulfill the requests of the client processes.
All of the kernel and device drivers are in ring 0 and all user applications are in ring 3. Since drivers run in this privileged mode, it is important the drivers be written properly and not be malicious in any way. Since many device drivers are provided by third parties, it is hard to know if they are developed properly and securely. This is why Microsoft created much stricter requirements for drivers in its operating system Vista. Third-party vendors that write drivers must now meet much more stringent criteria before the operating system will allow them to load.
Virtual Machines I would like my own simulated environment so I can have my own world. Response: No problem. Just slip on this straightjacket first. If you have been into computers for a while, you might remember computer games that did not have the complex, life-like graphics of today’s games. Pong and Asteroids were what we had to play with when we were younger. In those simpler times, the games were 16-bit and were written to work in a 16-bit MS-DOS environment. When our Windows operating systems moved from 16-bit to 32-bit, the 32-bit operating systems were written to be backward compatible, so someone could still load and play a 16-bit game in an environment that the game did not understand. The continuation of this little life pleasure was available to users because the operating systems created virtual machines for the games to run in. A virtual machine is a simulated environment. When a 16-bit application needs to interact with the operating system, it has been developed to make system calls and interact
ch05.indd 315
10/5/2007 11:52:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
316 Breaking It Down for the Exam The following statements summarize many of the critical concepts you need to understand: • Layering and data hiding provide protection to data and processes by implementing layers of abstraction. Access to sensitive processes and data can only take place through properly formatted requests that are sent to system APIs. This means the communication that takes place between the different layers of trust only happens through well-defined interfaces. Creating and maintaining these different layers helps protect data from other processes that are not authorized to access it. • If a process does not have an interface with which to communicate to another process at another layer, it cannot have access to its data. • The protection ring architecture allows for processes to either run in kernel or user mode. • Processes with a higher trust level (works in a lower number protection ring) have a larger domain than processes with lower trust levels. • Execution (protection) domains allow for the isolation of process activity, which provides protection and system stability. • Monolithic systems have all kernel activities running in supervisory mode, while microkernels have only a small subset of kernel activities running in this privileged mode. All other kernel activities run in user mode. with the computer’s memory in a way that would only work within a 16-bit operating system—not a 32-bit system. So, the virtual machine simulates a 16-bit operating system, and when the application makes a request, the operating system converts the 16-bit request into a 32-bit request (this is called thunking) and reacts to the request appropriately. When the system sends a reply to this request, it changes the 32-bit reply into a 16-bit reply so the application understands it. Although not many people run 16-bit games anymore, we do use virtual machines for other purposes. The product VMWare creates individual virtual machines so a user can run multiple operating systems on one computer at the same time. The Java Virtual Machine (JVM), used by basically every web browser today, creates virtual machines (called sandboxes) in which Java applets run. This is a protection mechanism, because the sandbox contains the applet and does not allow it to interact with the operating system and file system directly. The activities that the applet attempts to carry out are screened by the JVM to see if they are safe requests. If the JVM determines an activity is safe, then the JVM carries out the request on behalf of the applet. NOTE Malware has been written that escapes the “walls of the sandbox” so it can carry out its deeds without being under control of the JVM. These compromises, as well as Java and the JVM, will be covered in more detail in Chapter 11.
ch05.indd 316
10/5/2007 11:52:08 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
317 References • The Design of PARAS Microkernel, Chapter 2, “Operating System Models,” by Rajkumar Buyya (1998) www.gridbus.org/~raj/microkernel/chap2.pdf • Chapter 12, “Windows NT/2000,” by M.I. Vuskovic http://medusa.sdsu.edu/ cs570/Lectures/chapter12.pdf • Answers.com definitions of virtual machine www.answers.com/topic/ virtual-machine
Additional Storage Devices Besides the memory environment discussed previously, many types of physical storage devices should be covered, along with the ramifications of security compromises that could affect them. Many, if not all, of the various storage devices used today enable the theft or compromise of data in an organization. As their sizes have shrank, their capacities have grown. Floppy disks, while small in relative storage capacity (about 1.44MB of data), have long been known to be a source of viruses and data theft. A thief who has physical access to a computer with an insecure operating system can use a basic floppy disk to boot the system. Many PCs and Unix workstations have a BIOS that allows the machine to be booted from devices other than the floppy disk, such as a CD-ROM or even a USB thumb drive. Possible ways to harden the environment include password-protecting the BIOS, so that a nonapproved medium cannot take over the machine, and controlling access to the physical environment of the computer equipment. In many instances, removable storage units have unfortunately come up missing. Two noteworthy incidents occurred in July 2004, at which time both Los Alamos National Laboratory and Sandia National Laboratories reported lost storage media containing classified information. This raised enough of a concern at Los Alamos that the military research facility was totally shut down, with no employees allowed to enter, while a thorough search and investigation was performed. Sandia National Laboratories reported it was missing a computer floppy disk marked classified, which it later located. Rewritable CD/DVDs, mini-disks, optical disks—virtually any portable storage medium—can be used to compromise security. Current technology headaches for the security professional include USB thumb drives and USB-attachable MP3 players capable of storing multiple gigabytes of data. The first step in prevention is to update existing security policies (or implement new ones) to include the new technologies. Even cellular phones can be connected to computer ports for data, sound, image, and video transmission that could be out of bounds of an outdated security policy. Technologies such as Bluetooth, FireWire, and Blackberry all have to be taken into account when addressing security concerns and vulnerabilities.
Input/Output Device Management Some things come in, some things go out. Response: We took a vote and would like you to go out. We have covered a lot of operating system responsibilities up to now, and we are not stopping yet. An operating system also has to control all input/output devices. It sends
ch05.indd 317
10/5/2007 11:52:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
318 commands to them, accepts their interrupts when they need to communicate with the CPU, and provides an interface between the devices and the applications. I/O devices are usually considered block or character devices. A block device works with data in fixed-size blocks, each block with its own unique address. A disk drive is an example of a block device. A character device, such as a printer, network interface card, or mouse, works with streams of characters, without using any fixed sizes. This type of data is not addressable. When a user chooses to print a document, open a stored file on a word processor, or save files to a jump drive, these requests go from the application the user is working in, through the operating system, and to the device requested. The operating system uses a device driver to communicate with a device controller, which may be a circuit card that fits into an expansion slot. The controller is an electrical component with its own software that provides a communication path that enables the device and operating system to exchange data. The operating system sends commands to the device controller’s registers and the controller then writes data to the peripheral device or extracts data to be processed by the CPU, depending on the given commands. If the command is to extract data from the hard drive, the controller takes the bits and puts them into the necessary block size and carries out a checksum activity to verify the integrity of the data. If the integrity is successfully verified, the data are put into memory for the CPU to interact with. Operating systems need to access and release devices and computer resources properly. Different operating systems handle accessing devices and resources differently. For example, Windows NT is considered a stabler and safer data processing environment than Windows 9x because applications in Windows NT cannot make direct requests to hardware devices. Windows NT and Windows 2000 have a much more controlled method of accessing devices than Windows 9x. This method helps protect the system from badly written code that does not properly request and release resources. Such a level of protection helps ensure the resources’ integrity and availability.
Interrupts When an I/O device has completed whatever task was asked of it, it needs to inform the CPU that the necessary data are now in memory for processing. The device’s controller sends a signal down a bus, which is detected by the interrupt controller. (This is what it means to use an interrupt. The device signals the interrupt controller and is basically saying, “I am done and need attention now.”) If the CPU is busy and the device’s inter-
Why Does My Video Card Need to Have Its Own RAM? The RAM on a video card is really just a type of buffer. The application or operating system writes the pixel values into this RAM space instead of writing to the system’s RAM. The pixel values are then displayed to the user on the monitor screen. Graphic-intensive games work better with video cards with a lot of RAM, because storing this display information on the system’s RAM takes too long for the read and write procedures. This results in delayed reactions between the user’s interaction commands and what is displayed on the screen. We never seemed to have these problems when we all played Pong.
ch05.indd 318
10/5/2007 11:52:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
319 rupt is not a higher priority than whatever job is being processed, then the device has to wait. The interrupt controller sends a message to the CPU, indicating what device needs attention. The operating system has a table (called the interrupt vector) of all the I/O devices connected to it. The CPU compares the received number with the values within the interrupt vector so it knows which I/O device needs its services. The table has the memory addresses of the different I/O devices. So when the CPU understands that the hard drive needs attention, it looks in the table to find the correct memory address. This is the new program counter value, which is the initial address of where the CPU should start reading from. One of the main goals of the operating system software that controls I/O activity is to be device independent. This means a developer can write an application to read (open a file) or write (save a file) to any device (floppy disk, jump drive, hard drive, CD-ROM drive). This level of abstraction frees application developers from having to write different procedures to interact with the various I/O devices. If a developer had to write an individual procedure of how to write to a CD-ROM drive, and how to write to a floppy disk, and how to write to a jump drive, and how to write to a hard disk, and so on, each time a new type of I/O device was developed, all of the applications would have to be patched or upgraded. Operating systems can carry out software I/O procedures in various ways. We will look at the following methods: • Programmed I/O • Interrupt-driven I/O • I/O using DMA • Premapped I/O • Fully mapped I/O Programmable I/O If an operating system is using programmable I/O, this means the CPU sends data to an I/O device and polls the device to see if it is ready to accept more data. If the device is not ready to accept more data, the CPU wastes time by waiting for the device to become ready. For example, the CPU would send a byte of data (a character) to the printer and then ask the printer if it is ready for another byte. The CPU sends the text to be printed one byte at a time. This is a very slow way of working and wastes precious CPU time. So the smart people figured out a better way: interruptdriven I/O. Interrupt-Driven I/O If an operating system is using interrupt-driven I/O, this means the CPU sends a character over to the printer and then goes and works on another process’s request. When the printer is done printing the first character, it sends an interrupt to the CPU. The CPU stops what it is doing, sends another character to the printer, and moves to another job. This process (send character—go do something else—interrupt—send another character) continues until the whole text is printed. Although the CPU is not waiting for each byte to be printed, this method does waste a lot of time dealing with all the interrupts. So we excused those smart people and brought in some smarter people, who came up with I/O using DMA.
ch05.indd 319
10/5/2007 11:52:09 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
320 I/O Using DMA Direct memory access (DMA) is a way of transferring data between I/O devices and the system’s memory without using the CPU. This speeds up data transfer rates significantly. When used in I/O activities, the DMA controller feeds the characters to the printer without bothering the CPU. This method is sometimes referred to as unmapped I/O. Premapped I/O Premapped I/O and fully mapped I/O (described next) do not pertain to performance, as do the earlier methods, but provide two approaches that can directly affect security. In a premapped I/O system, the CPU sends the physical memory address of the requesting process to the I/O device, and the I/O device is trusted enough to interact with the contents of memory directly. So the CPU does not control the interactions between the I/O device and memory. The operating system trusts the device to behave properly. Scary. Fully Mapped I/O Under fully mapped I/O, the operating system does not fully trust the I/O device. The physical address is not given to the I/O device. Instead, the device works purely with logical addresses and works on behalf (under the security context) of the requesting process. So the operating system does not trust the device to interact with memory directly. The operating system does not trust the process or device and acts as the broker to control how they communicate with each other.
References • Chapter 12, “I/O Management and Disk Scheduling,” by Joseph Kee-Yin www.comp.hkbu.edu.hk/~jng/comp2320/2320-C11.ppt • Introduction to Operating Systems, by B. Ramamurthy (1/25/2002) www.cse.buffalo.edu/faculty/bina/cse421/spring02/jan25.pdf
Beam Me Up, Scotty! A cofounder of Intel, Gordon Moore came up with Moore’s Law, which states that the number of electronic components (transistors, capacitors, diodes) will double every 18 months. No one really paid attention to this until it came to be true every 18 months or so. Now he’s right up there with Nostradamus. So chip makers have continually put an amazing amount of stuff on one tiny piece of silicon, but we will soon hit the wall and have to look for other types of technologies. Today, people are looking at quantum physics to make up tomorrow’s processor. In quantum physics, particles are not restricted to holding just two states (1 or 0), but instead can hold these states simultaneously and other states in between. Freaky. And other individuals are looking to our own personal DNA, which holds the instructions for our bodies. There have already been experiments in which DNA was used for computation processes. It can carry out complex computations in parallel instead of serially like today’s processors. But it sounds kind of gross. You won’t find a quantum or DNA computer at Best Buy any time soon, but one day maybe.
ch05.indd 320
10/5/2007 11:52:10 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
321
System Architecture Designing a system from the ground up is a complicated task with many intricate and abstract goals that must be achieved through mathematics, logic, design, programming code, and implementation. Fundamental design decisions must be made when constructing a system. Security is only one goal of a system, but it is the goal security professionals are most concerned about. Availability, integrity, and confidentiality can be enforced at different places within an enterprise. For example, a company may store customer credit card information in a database that many users can access. This information, obviously, requires protection to ensure it is not accessed or modified in an unauthorized manner. We should start with general questions and gradually drill down into the details. Where should this protection be placed? Should there be access controls that screen users when they log in and assign them their rights at that point, dictating which data they can and cannot access? Should the data files holding the credit card information be protected at the file system level? Should protection be provided by restricting users’ operations and activities? Or should there be a combination of all of these? The first and most general question is, “Where should the protection take place: at the user’s end, where the data are stored, or by restricting user activities within the environment?” This is illustrated in Figure 5-15. The same type of questions have to be answered when building an operating system. Once these general questions have been answered, the placement of the mechanisms needs to be addressed. Security mechanisms can be placed at the hardware, kernel, operating system, services, or program layers. At which layer(s) should security mechanisms be implemented? If protection is implemented at the hardware layer, then a broad level of protection is provided, because it provides a baseline of security for all the components that work on top of the hardware layer. If the protection mechanisms are closer to the user (in the higher levels of the operating system architecture), the security is more detail-oriented and focused than mechanisms that work at the lower levels of the architecture. No matter where the security mechanism is placed within the operating system architecture, the more complex the security mechanism becomes, the less assurance it usually provides. The reason is that greater complexity of the mechanism demands more technical understanding from the individuals who install, test, maintain, and use it. The more complex the security mechanism, the harder it is to fully test it under all possible conditions. On the other hand, simplistic mechanisms may not be able to provide the
Figure 5-15 Security can take place in three main areas.
ch05.indd 321
10/5/2007 11:52:10 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
322 desired richness of functionality and options, although they are easier to install, maintain, use, and test. So the trade-offs between functionality and assurance must be fully understood to make the right security mechanism choices when designing a system. Once the designers have an idea of what the security mechanisms should focus on (users, operations, or data), what layer(s) the mechanisms should be placed at (hardware, kernel, operating system, services, or program), and how complex each mechanism is, they need to build and integrate the mechanisms in such a way that they have a proper relationship with other parts of the system. First, the design team needs to decide what system mechanisms to trust and place in protection ring 0. Then, the team must specify how these modules of code can interact in a secure manner. Although it might seem that you would want to trust all the components within the system, this would cause too much overhead, complexity, and performance bottlenecks. For a mechanism to be trusted, it must perform in a predictable and secure manner and not adversely affect other trusted or untrusted mechanisms. In return, these trusted components have access to more privileged services, have direct access to memory, usually have higher priority when requesting CPU processing time, and have more control over system resources. So the trusted subjects and objects need to be identified and distinguished from the untrusted ones and placed into defined subsets.
Defined Subsets of Subjects and Objects I totally trust you. You can do whatever you want. Response: I want to leave. As stated previously, not all components need to be trusted and therefore not all components fall within the trusted computing base (TCB). The TCB is defined as the total combination of protection mechanisms within a computer system. The TCB includes hardware, software, and firmware. These are part of the TCB because the system is sure these components will enforce the security policy and not violate it. The components that do fall within the TCB need to be identified and their accepted capabilities need to be defined. For example, a system that does not require a high level of trust may permit all authenticated users to access and modify all files on the computer. This subset of subjects and objects is large and the relationship between them is loose and relaxed. A system that requires a higher level of trust may permit only two subjects to access all files on a computer system, and permit only one of those subjects to actually modify all the files. This subset is much smaller and the rules being enforced are more stringent and detailed.
Security Architecture The security architecture is one component of a product’s overall architecture and is developed to provide guidance during the design of the product. It should outline the level of assurance required and the potential impacts this level of security could have during the development stages and on the product overall. As the software development project moves from architecture, to design, to specifications, and then code development, the security architecture and requirements become more granular with each step.
ch05.indd 322
10/5/2007 11:52:10 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
323 If developers want to develop a system that achieves an Orange Book assurance rating of D (very low), then what makes up the TCB is not much of an issue because the system will not be expected to provide a very high level of security. However, if the developers want to develop a system with an Orange Book rating of B2 or B1 (much higher than rating D), they will need to ensure that all components of the TCB carry out their tasks properly. These TCB components need to enforce strict rules that dictate how subjects and objects interact. The developers also need to ensure these components are identified, audited, and react in a predictable manner, because these are the components that will be scrutinized, tested, and evaluated before a rating of B2 or B1 can be given. (The Orange Book is an evaluation criterion and is addressed in the section “The Orange Book” later in the chapter.)
Trusted Computing Base The term “trusted computing base,” which originated from the Orange Book, does not address the level of security a system provides, but rather the level of trust a system provides, albeit in a security sense. This is because no computer system can be totally secure. The types of attacks and vulnerabilities change and evolve over time, and with enough time and resources, most attacks become successful. However, if a system meets a certain criteria, it is looked upon as providing a certain level of trust, meaning it will react predictably in different types of situations. The TCB does not address only operating system components, because a computer system is not made up of only an operating system. The TCB addresses hardware, software components, and firmware. Each can affect the computer’s environment in a negative or positive manner, and each has a responsibility to support and enforce the security policy of that particular system. Some components and mechanisms have direct responsibilities in supporting the security policy, such as firmware that will not let a user boot a computer from a floppy disk, or the memory manager that will not let processes overwrite other processes’ data. Then there are components that do not enforce the security policy but must behave properly and not violate the trust of a system. Examples of the ways in which a component could violate the system’s security policy include an application that attempts to make a direct call to a piece of hardware instead of using the proper system calls through the operating system, a program that attempts to read data outside of its approved memory space, or a piece of software that does not properly release resources after use. A TCB is usually a very abstract concept for people who are not system designers, and many books or papers do not make it any easier to fully understand what this term means. If an operating system is using a TCB, this means the system has a hardened kernel that compartmentalizes system processes. The kernel is made up of hardware, software, and firmware, so in a sense the kernel is the TCB. But the TCB can include other components, such as trusted commands, programs, and configuration files that can directly interact with the kernel. For example, when installing a Unix system, the administrator can choose to install the TCB during the setup procedure. If the TCB is enabled, then the system has a trusted path, a trusted shell, and system integrity–checking capabilities. A trusted path is a communication channel between the user, or program, and the kernel. The TCB provides protection resources to ensure this channel cannot be compromised in any way. A trusted shell means that someone who is working in that shell cannot “bust out of it,” and other processes cannot “bust into it.”
ch05.indd 323
10/5/2007 11:52:11 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
324 Several Unix commands are part of the TCB, such as setuid (set process ID) and setguid (set process group ID). Only a privileged user, as in root, should be able to change process ID information. Earlier operating systems (MS-DOS, Windows 3.11, and Novell Netware release 3, for example) did not have TCBs. Windows 95 has a TCB, but it can be used only while working in 32-bit mode. Windows NT was the first version of Windows that truly incorporated the idea of a TCB. Microsoft is using the words “Trustworthy Computing” a lot, but this is not just a Microsoft concept. Several vendors came together to develop a better TCB by agreeing to improve methods on how to protect software from being compromised. Microsoft is just the first vendor to implement it, in its Windows 2003 product. Microsoft is basically building upon its current TCB and calling it the NextGeneration Secure Computing Base (NGSCB). (It must be better. It has a longer name!) And Microsoft renamed its security kernel “nexus.” How NGSCB actually works is beyond the scope of this book and the exam, but basically the operating system is doing what it is supposed to be doing, only better—better isolation between trusted and untrusted processes, better memory management, more secure I/O operations, and better software authentication mechanisms. So we are all one step closer to more secure systems and world peace. NOTE To understand Microsoft’s Vista kernel, visit www.microsoft.com/ technet/technetmag/issues/2007/02/VistaKernel.
Every operating system has specific components that would cause the system grave danger if they were compromised. The TCB provides extra layers of protection around these mechanisms to help ensure they are not compromised, so the system will always run in a safe and predictable manner. How does the TCB do its magic? The processes within the TCB are the components that protect the system overall. So the developers of the operating system must make sure these processes have their own execution domain. This means they reside in ring 0, their instructions are executed in privileged state, and no less trusted processes can directly interact with them. The developers need to ensure the operating system maintains an isolated execution domain, so their processes cannot be compromised or tampered with. The resources that the TCB processes use must also be isolated, so tight access control can be provided and all access requests and operations can be properly audited. So basically, the operating system tells all the other processes they cannot play with the TCB processes and that they cannot play with the TCB’s resources. The four basic functions of the TCB are process activation, execution domain switching, memory protection, and I/O operations. We have really covered all of these things already throughout previous sections without using this exact terminology, so here’s a recap. Process activation deals with the activities that must take place when a process is going to have its instructions and data processed by the CPU. As described earlier, the CPU fills its registers with information about the requesting process (program counter, base and limit addresses, user or privileged mode, and so on). A process is “activated” when its interrupt is called upon, enabling it to interact with the CPU. A process is “de-
ch05.indd 324
10/5/2007 11:52:11 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
325 activated” when its instructions are completely executed by the CPU or when another process with a higher priority calls upon the CPU. When a process is deactivated, the CPU’s registers must be filled with new information about the new requesting process. The data that is getting switched in and out of the registers may be sensitive in nature, so the TCB components must make sure all of this is taking place securely. For an analogy, suppose that five people all want to ask your advice at the same time. There is only one of you, so each person has a certain amount of time that they can spend with you. Person 1 gives you her papers, so you can read through them and figure out her problem in order to give her a proper answer. As you are reading Person 1’s papers, Person 2 comes barging into the room claiming he has an emergency. As a result, you put Person 1’s papers down on your desk and start reading Person 2’s papers to figure out his problem. Eventually, you have five people around you, and you can only spend five seconds with each of them at a time. As you talk to one individual, you must grab the right file from your desk. These files have sensitive information, so you have to make sure to keep all the files straight and make sure these people cannot read one another’s files. This is what the TCB and the CPU are doing as they are dealing with several different process requests at one time. Instead of reading stacks of paper, the CPU reads instructions and data on a memory segment stack. Execution domain switching takes place when a process needs to call upon a process in a higher protection ring. As explained earlier, less trusted processes run in user mode and cannot carry out activities such as communicating with hardware or directly sending requests to the kernel. Therefore, a process running in user mode (ring 3) must make a request to an operating system service, which works in ring 1. The less trusted process will have its information loaded into the CPU’s registers and then when the CPU sees that an operating system service has been called, it switches domains and security context. This means the information of the operating system service process is loaded into the CPU’s registers and the CPU carries out those instructions in privileged mode. So, execution domain switching refers to when the CPU has to go from executing instructions in user mode to privileged mode and back. All of this must happen properly or a less trusted process might be executed in privileged mode and have direct access to system resources. Memory protection and I/O operations have been discussed in previous sections, so just realize that these operations are the responsibility of the components within the TCB. The TCB is responsible for carrying out the TCB memory protection and I/O operations securely. It does this by compartmentalizing these activities into discrete units, which are the processes that make up the kernel. This ensures that if a kernel process is compromised, it does not mean all the processes are now under the control of the attacker. Not every part of a system needs to be trusted. Part of evaluating the trust level of a system is to identify the architecture, security services, and assurance mechanisms that make up the TCB. During the evaluation process, the tests must show how the TCB is protected from accidental or intentional tampering and compromising activity. For systems to achieve a higher trust level rating, they must meet well-defined TCB requirements, and the details of their operational states, developing stages, testing procedures, and documentation will be reviewed with more granularity than systems attempting to achieve a lower trust rating.
ch05.indd 325
10/5/2007 11:52:11 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
326 By using specific security criteria, trust can be built into a system, evaluated, and certified. This approach can provide a measurement system for customers to use when comparing one product to another. It also gives vendors guidelines on what expectations are put upon their systems and provides a common assurance rating metric so when one group talks about a C2 rating, everyone else understands what that term means. The Orange Book is one of these evaluation criteria. It defines a trusted system as hardware and software that utilize measures to protect unclassified or classified data for a range of users without violating access rights and the security policy. It looks at all protection mechanisms within a system that enforce the security policy and provide an environment that will behave in a manner expected of it. This means each layer of the system must trust the underlying layer to perform the expected functions, provide the expected level of protection, and operate in an expected manner under many different situations. When the operating system makes calls to hardware, it anticipates that data will be returned in a specific data format and behave in a consistent and predictable manner. Applications that run on top of the operating system expect to be able to make certain system calls, receive the required data in return, and operate in a reliable and dependable environment. Users expect the hardware, operating system, and applications to perform in particular fashions and provide a certain level of functionality. For all of these actions to behave in such predicable manners, the requirements of a system must be addressed in the planning stages of development, not afterwards.
Security Perimeter Now, whom do we trust? Response: Anyone inside the security perimeter. As stated previously, not every process and resource falls within the TCB, so some of these components fall outside of an imaginary boundary referred to as the security perimeter. A security perimeter is a boundary that divides the trusted from the untrusted. For the system to stay in a secure and trusted state, precise communication standards must be developed to ensure that when a component within the TCB needs to communicate with a component outside the TCB, the communication cannot expose the system to unexpected security compromises. This type of communication is handled and controlled through interfaces. For example, a resource that is within the boundary of the TCB, or security perimeter, must not allow less trusted components access to critical system resources. The processes within the TCB must also be careful about the commands and information they accept from less trusted resources. These limitations and restrictions are built into the interfaces that permit this type of communication to take place and are the mechanisms that enforce the security perimeter. Communication between trusted components and untrusted components needs to be controlled to ensure that the system stays stable and safe.
ch05.indd 326
10/5/2007 11:52:11 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
327 NOTE The TCB and security perimeter are not physical entities, but conceptual constructs used by system developers to delineate between trusted and untrusted components.
Reference Monitor and Security Kernel Up to now, our computer system architecture developers have accomplished many things in developing their system. They have defined where the security mechanisms will be located (hardware, kernel, operating system, services, or programs), the processes that are within the TCB, and how the security mechanisms and processes will interact with each other. They have defined the security perimeter that separates the trusted and untrusted components. They have developed proper interfaces for these entities to communicate securely. Now they need to develop and implement a mechanism that ensures that the subjects that access objects have been given the necessary permissions to do so. This means the developers need to develop and implement a reference monitor and security kernel. The reference monitor is an abstract machine that mediates all access subjects have to objects, both to ensure that the subjects have the necessary access rights and to protect the objects from unauthorized access and destructive modification. For a system to achieve a higher level of trust, it must require subjects (programs, users, or processes) to be fully authorized prior to accessing an object (file, program, or resource). A subject must not be allowed to use a requested resource until the subject has proven it has been granted access privileges to use the requested object. The reference monitor is an access control concept, not an actual physical component, which is why it is normally referred to as the “reference monitor concept” or an “abstract machine.” The security kernel is made up of hardware, software, and firmware components that fall within the TCB and implements and enforces the reference monitor concept. The security kernel mediates all access and functions between subjects and objects. The security kernel is the core of the TCB and is the most commonly used approach to building trusted computing systems. The security kernel has three main requirements: • It must provide isolation for the processes carrying out the reference monitor concept, and the processes must be tamperproof. • It must be invoked for every access attempt and must be impossible to circumvent. Thus, the security kernel must be implemented in a complete and foolproof way. • It must be small enough to be tested and verified in a complete and comprehensive manner. These are the requirements of the reference monitor; therefore, they are the requirements of the components that provide and enforce the reference monitor concept—the security kernel.
ch05.indd 327
10/5/2007 11:52:12 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
328 These issues work in the abstract but are implemented in the physical world of hardware devices and software code. The assurance that the components are enforcing the abstract idea of the reference monitor is proved through testing and functionality. NOTE The reference monitor is a concept in which an abstract machine mediates all access to objects by subjects. The security kernel is the hardware, firmware, and software of a TCB that implements this concept. The TCB is the totality of protection mechanisms within a computer system that work together to enforce a security policy. The TCB contains the security kernel and all other security protection mechanisms. The following is a quick analogy to show you the relationship between the processes that make up the kernel, the kernel itself, and the reference monitor concept. Individuals make up a society. The individuals represent the processes, and the society represents the kernel. For a society to have a certain standard of living, its members must interact in specific ways, which is why we have laws. The laws represent the reference monitor, which enforces proper activity. Each individual is expected to stay within the bounds of the laws and act in specific ways so society as a whole is not adversely affected and the standard of living is not threatened. The components within a system must stay within the bounds of the reference monitor’s laws so they will not adversely affect other components and threaten the security of the system.
References • “Rationale Behind the Evaluation Classes” www.kernel.org/pub/linux/libs/ security/Orange-Linux/refs/Orange/OrangeI-II-6.html • The Reference Monitor Concept http://citeseer.ist.psu.edu/299300.html • Implementing Complete Mediation www.cs.cornell.edu/html/cs513-sp99/ NL05.html
Security Policy As previously stated, the TCB contains components that directly enforce the security policy, but what is a security policy? A security policy is a set of rules and practices that dictates how sensitive information and resources are managed, protected, and distributed. A security policy expresses exactly what the security level should be by setting the goals of what the security mechanisms are supposed to accomplish. This is an important element that has a major role in defining the design of the system. The security policy is a foundation for the specifications of a system and provides the baseline for evaluating a system. Chapter 3 examined security policies in depth, but those policies were directed toward the company itself. The security policies being addressed here are for operating systems, devices, and applications. The different policies are similar but have different targets: an organization as opposed to an individual computer system.
ch05.indd 328
10/5/2007 11:52:12 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
329 A system provides trust by fulfilling and enforcing the security policy and oversees the communication between subjects and objects. The policy must indicate which subjects can access individual objects, and which actions are acceptable and unacceptable. The security policy provides the framework for the system’s security architecture. For a system to provide an acceptable level of trust, it must be based on an architecture that provides the capabilities to protect itself from untrusted processes, intentional or accidental compromises, and attacks at different layers of the system. A majority of the trust ratings obtained through formal evaluations require a defined subset of subjects and objects, explicit domains, and the isolation of processes so their access can be controlled and the activities performed on them can be audited. Let’s regroup. We know that a system’s trust is defined by how it enforces its own security policy. When a system is tested against specific criteria, a rating is assigned to the system and this rating is used by customers, vendors, and the computing society as a whole. The criteria will determine if the security policy is being properly supported and enforced. The security policy lays out the rules and practices pertaining to how a system will manage, protect, and allow access to sensitive resources. The reference monitor is a concept that says all subjects must have proper authorization to access objects, and this concept is implemented by the security kernel. The security kernel comprises all the resources that supervise system activity in accordance with the system’s security policy and is part of the operating system that controls access to system resources. For the security kernel to work correctly, the individual processes must be isolated from each other and domains must be defined to dictate which objects are available to which subjects. Security policies that prevent information from flowing from a high security level to a lower security level are called multilevel security policies. These types of policies permit a subject to access an object only if the subject’s security level is higher than or equal to the object’s classification. As previously stated, the concepts covered in the previous sections are abstract ideas that will be manifested in physical hardware components, firmware, software code, and activities through designing, building, and implementing a system. These ideas are like abstract goals and dreams we would like to accomplish, which are obtained by our physical hard work and discipline.
Least Privilege Once resources and processes are isolated properly, least privilege needs to be enforced. This means that a process has no more privileges than necessary to be able to fulfill its functions. Only processes that need to carry out critical system functions should be allowed to, and other, less privileged processes should call upon the more privileged processes to carry out these types of activities when necessary. This type of indirect activity protects the system from poorly written or misbehaving code. Processes should possess a level of privilege only as long as they really need it. If a process needs to have its status elevated so it can interact directly with a system resource, as soon as its tasks are complete, the process’s status should be dropped to a lower privilege to ensure that another mechanism cannot use it to adversely affect the system. Only processes that need complete system privileges are located in the kernel—other, less privileged processes call upon them to process sensitive or delicate operations.
ch05.indd 329
10/5/2007 11:52:12 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
330 As an example of least privilege access control, the system backup program may have read access on the files, but it does not need to be able to modify the files. Similarly, the restore program would be allowed to write files to the disk, but not to read them.
Security Models An important concept in the design and analysis of secure systems is the security model, because it incorporates the security policy that should be enforced in the system. A model is a symbolic representation of a policy. It maps the desires of the policymakers into a set of rules that a computer system must follow. The reason this chapter has repeatedly mentioned the security policy and its importance is that it is an abstract term that represents the objectives and goals a system must meet and accomplish to be deemed secure and acceptable. How do we get from an abstract security policy to the point at which an administrator is able to uncheck a box on the GUI to disallow David from accessing configuration files on his system? There are many complex steps in between that take place during the system’s design and development. A security model maps the abstract goals of the policy to information system terms by specifying explicit data structures and techniques necessary to enforce the security policy. A security model is usually represented in mathematics and analytical ideas, which are then mapped to system specifications, and then developed by programmers through programming code. So we have a policy that encompasses security goals like “each subject must be authorized to access each object.” The security model takes this requirement and provides the necessary mathematical formulas, relationships, and structure to be followed to accomplish this goal. From there, specifications are developed per operating system type (Unix, Windows, Macintosh, and so on), and individual vendors can decide how they are going to implement mechanisms that meet these necessary specifications. So in a very general and simplistic example, if a security policy states that subjects need to be authorized to access objects, the security model would provide the mathematical relationships and formulas explaining how x can access y only through the outlined specific methods. Specifications are then developed to provide a bridge to what this means in a computing environment and how it maps to components and mechanisms that need to be coded and developed. The developers then write the program code to produce the mechanisms that provide a way for a system to use ACLs and give administrators some degree of control. This mechanism presents the network ad-
Relationship Between a Security Policy and a Security Model If someone tells you to live a healthy and responsible life, this is a very broad, vague, and abstract notion. So when you ask this person how this is accomplished, they outline the things you should and should not do (do not harm others, do not lie, eat your vegetables, and brush your teeth). The security policy provides the abstract goals, and the security model provides the dos and don’ts necessary to fulfill these goals.
ch05.indd 330
10/5/2007 11:52:13 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
331 ministrator with a GUI that enables the administrator to choose (via check boxes, for example) which subjects can access what objects, to be able to set this configuration within the operating system. This is a rudimentary example, because security models can be very complex, but it is used to demonstrate the relationship between the security policy and the security model. Some security models, such as the Bell-LaPadula model, enforce rules to provide confidentiality protection. Other models, such as the Biba model, enforce rules to provide integrity protection. Formal security models, such as Bell-LaPadula and Biba, are used to provide high assurance in security. Informal models, such as Clark-Wilson, are used more as a framework to describe how security policies should be expressed and executed. A security policy outlines goals without regard to how they will be accomplished. A model is a framework that gives the policy form and solves security access problems for particular situations. Several security models have been developed to enforce security policies. The following sections provide overviews of each model.
State Machine Models No matter what state I am in, I am always safe. In state machine models, to verify the security of a system, the state is used, which means that all current permissions and all current instances of subjects accessing objects must be captured. Maintaining the state of a system deals with each subject’s association with objects. If the subjects can access objects only by means that are concurrent with the security policy, the system is secure. State machines have provided a basis for important security models. A state of a system is a snapshot of a system at one moment of time. Many activities can alter this state, which are referred to as state transitions. The developers of an operating system that will implement the state machine model need to look at all the different state transitions that are possible and assess whether a system that starts up in a secure state can be put into an insecure state by any of these events. If all of the activities that are allowed to happen in the system do not compromise the system and put it into an insecure state, then the system executes a secure state machine model.
Formal Models Using models in software development has not become as popular as once imagined, primarily because vendors are under pressure to get products to market as soon as possible. Using formal models takes more time during the architectural phase of development, extra time that many vendors feel they cannot afford. Formal models are definitely used in the development of systems that cannot allow errors or security breaches, such as air traffic control systems, spacecraft software, railway signaling systems, military classified systems, and medical control systems. This does not mean that these models, or portions of them, are not used in industry products, but rather that industry vendors do not always follow these models in the purely formal and mathematical way that the models were designed for.
ch05.indd 331
10/5/2007 11:52:13 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
332 The state machine model is used to describe the behavior of a system to different inputs. It provides mathematical constructs that represent sets (subjects and objects) and sequences. When an object accepts an input, this modifies a state variable. A simplistic example of a state variable is (Name, Value), as shown in Figure 5-16. This variable is part of the operating system’s instruction set. When this variable is called upon to be used, it can be populated with (Color, Red) from the input of a user or program. Let’s say the user enters a different value, so now the variable is (Color, Blue). This is a simplistic example of a state transition. Some state transitions are this simple, but complexity comes in when the system must decide if this transition should be allowed. To allow this transition, the object’s security attributes and the access rights of the subject must be reviewed and allowed by the operating system. Developers who implement the state machine model must identify all the initial states (default variable values) and outline how these values can be changed (inputs that will be accepted) so the various number of final states (resulting values) still ensure that the system is safe. The outline of how these values can be changed is often implemented through condition statements: “if condition then update.” A system that has employed a state machine model will be in a secure state in each and every instance of its existence. It will boot up into a secure state, execute commands and transactions securely, allow subjects to access resources only in secure states, and
Figure 5-16 A simplistic example of a state change
ch05.indd 332
10/5/2007 11:52:13 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
333 shut down and fail in a secure state. Failing in a secure state is extremely important. It is imperative that if anything unsafe takes place, the system must be able to “save itself” and not make itself vulnerable. When an operating system displays an error message to the user or reboots or freezes, it is executing a safety measure. The operating system has experienced something that is deemed illegal and it cannot take care of the situation itself, so to make sure it does not stay in this insecure state, it reacts in one of these fashions. Thus, if an application or system freezes on you, know that it is simply the system trying to protect itself and your data. Several points should be considered when developing a product that uses a state machine model. Initially, the developer must define what and where the state variables are. In a computer environment, all data variables could independently be considered state variables, and an inappropriate change to one could conceivably change or corrupt the system or another process’s activities. Next, the developer must define a secure state for each state variable. The next step is to define and identify the allowable state transition functions. These functions will describe the allowable changes that can be made to the state variables. After the state transition functions are defined, they must be tested to verify that the overall machine state will not be compromised and that these transition functions will keep the integrity of the system (computer, data, program, or process) intact at all times.
The Bell-LaPadula Model I don’t want anyone to know my secrets. Response: We need Mr. Bell and Mr. LaPadula in here then. In the 1970s, the U.S. military used time-sharing mainframe systems and was concerned about the security of these systems and leakage of classified information. The Bell-LaPadula model was developed to address these concerns. It was the first mathematical model of a multilevel security policy used to define the concept of a secure state machine and modes of access and outlined rules of access. Its development was funded by the U.S. government to provide a framework for computer systems that would be used to store and process sensitive information. The model’s main goal was to prevent secret information from being accessed in an unauthorized manner. A system that employs the Bell-LaPadula model is called a multilevel security system because users with different clearances use the system, and the system processes data with different classifications. The level at which information is classified determines the handling procedures that should be used. The Bell-LaPadula model is a state machine model that enforces the confidentiality aspects of access control. A matrix and security levels are used to determine if subjects can access different objects. The subject’s clearance is compared to the object’s classification and then specific rules are applied to control how subject-to-object interactions can take place. This model uses subjects, objects, access operations (read, write, and read/write), and security levels. Subjects and objects can reside at different security levels and will have relationships and rules dictating the acceptable activities between them. This model, when properly implemented and enforced, has been mathematically proven to provide a very secure and effective operating system. It is an information-flow security model also, which means that information does not flow in an insecure manner.
ch05.indd 333
10/5/2007 11:52:14 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
334 The Bell-LaPadula model is a subject-to-object model. An example would be how you (subject) could read a data element (object) from a specific database and write data into that database. The Bell-LaPadula model focuses on ensuring that subjects are properly authenticated—by having the necessary security clearance, need to know, and formal access approval—before accessing an object. Three main rules are used and enforced in the Bell-LaPadula model: the simple security rule, the *-property (star property) rule, and the strong star property rule. The simple security rule states that a subject at a given security level cannot read data that reside at a higher security level. For example, if Bob is given the security clearance of secret, this rule states he cannot read data classified as top secret. If the organization wanted Bob to be able to read top-secret data, it would have given him that clearance in the first place. The *-property rule (star property rule) states that a subject in a given security level cannot write information to a lower security level. The simple security rule is referred to as the “no read up” rule, and the *-property rule is referred to as the “no write down” rule, as shown in Figure 5-17. The third rule, the strong star property rule, states that a subject that has read and write capabilities can only perform those functions at the same security level, nothing higher and nothing lower. So, for a subject to be able to read and write to an object, the clearance and classification must be equal. These three rules indicate what states the system can go into. Remember that a state is the values of the variables in the software at a snapshot in time. If a subject has performed a read operation on an object at a lower security level, the subject now has a variable that is populated with the data that was read, or copied into its variable. If a subject has written to an object at a higher security level, the subject has modified a variable within that object’s domain.
Figure 5-17 In the Bell-LaPadula model, each subject has a lattice of rights.
ch05.indd 334
10/5/2007 11:52:14 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
335 NOTE In access control terms, the word dominate means to be higher than or equal to. So if you see a statement such as “A subject can only perform a read operation if the access class of the subject dominates the access class of an object,” this just means the subject must have a clearance that is higher than or equal to the object. In the Bell-LaPadula model, this is referred to as the dominance relation, which is the relationship of the subject’s clearance to the object’s classification. The state of a system changes as different operations take place. The Bell-LaPadula model defines a secure state, meaning a secure computing environment and the allowed actions, which are security-preserving operations. This means the model provides a secure state and only permits operations that will keep the system within a secure state and not let it enter into an insecure state. So if 100 people access 2000 objects in a day using this one system, this system is put through a lot of work and several complex activities must take place. However, at the end of the day, the system is just as secure as it was at the beginning of the day. This is the definition of the Basic Security Theorem used in computer science, which states that if a system initializes in a secure state and all allowed state transitions are secure, then every subsequent state will be secure no matter what inputs occur. NOTE The tranquility principle, which is also used in this model, means that subjects and objects cannot change their security levels once they have been instantiated (created). An important thing to note is that the Bell-LaPadula model was developed to make sure secrets stay secret; thus, it provides and addresses confidentiality only. This model does not address the integrity of the data the system maintains—only who can and cannot access the data and what operations can be carried out. NOTE Ensuring that information does not flow from a higher security level to a lower level is referred to as controlling unauthorized downgrading of information, which would take place through a “write down” operation. An actual compromise occurs if and when a user at a lower security level reads this data. So what does this mean and why does it matter? Chapter 4 discussed mandatory access control (MAC) systems versus discretionary access control (DAC) systems. All MAC systems are based on the Bell-LaPadula model, because it allows for multilevel security to be integrated into the code. Subjects and objects are assigned labels. The subject’s label contains its clearance label (top secret, secret, or confidential) and the object’s label contains its classification label (top secret, secret, or confidential). When a subject attempts to access an object, the system compares the subject’s clearance label and the object’s classification label and looks at a matrix to see if this is a legal and secure activity. In our scenario, it is a perfectly fine activity, and the subject is given access to the
ch05.indd 335
10/5/2007 11:52:14 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
336 object. Now, if the subject’s clearance label is top secret and the object’s classification label is secret, the subject cannot write to this object, because of the *-property rule, which makes sure that subjects cannot accidentally or intentionally share confidential information by writing to an object at a lower security level. As an example, suppose that a busy and clumsy general (who has top secret clearance) in the army opens up a briefing letter (which has a secret classification) that will go to all clerks at all bases around the world. He attempts to write that the United States is attacking Cuba. The Bell-LaPadula model will come into action and not permit this general to write this information to this type of file because his clearance is higher than that of the memo. Likewise, if a nosey military staff clerk tried to read a memo that was available only to generals and above, the Bell-LaPadula model would stop this activity. The clerk’s clearance is lower than that of the object (the memo), and this violates the simple security rule of the model. It is all about keeping secrets secret. NOTE It is important that MAC operating systems and MAC databases follow these rules. In Chapter 11, we will look at how databases can follow these rules by the use of polyinstantiation.
CAUTION You may run into the Bell-LaPadula rule called Discretionary Security Property (ds-property), which is another property of this model. This rule is based on named subjects and objects. It specifies that specific permissions allow a subject to pass on permissions at its own discretion. These permissions are stored in an access matrix. This just means that mandatory and discretionary access control mechanisms can be implemented in one operating system.
The Biba Model The Biba model was developed after the Bell-LaPadula model. It is a state machine model and is very similar to the Bell-LaPadula model. Biba addresses the integrity of data within applications. The Bell-LaPadula model uses a lattice of security levels (top secret, secret, sensitive, and so on). These security levels were developed mainly to ensure that sensitive data were only available to authorized individuals. The Biba model
Rules to Know The main rules of the Bell-LaPadula model that you need to understand are: • Simple security rule A subject cannot read data within an object that resides at a higher security level (“No read up” rule). • *- property rule A subject cannot write to an object at a lower security level (“No write down” rule). • Strong star property rule For a subject to be able to read and write to an object, the subject’s clearance and the object’s classification must be equal.
ch05.indd 336
10/5/2007 11:52:15 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
337 is not concerned with security levels and confidentiality, so it does not base access decisions upon this type of lattice. The Biba model uses a lattice of integrity levels. If implemented and enforced properly, the Biba model prevents data from any integrity level from flowing to a higher integrity level. Biba has three main rules to provide this type of protection: • *-integrity axiom A subject cannot write data to an object at a higher integrity level (referred to as “no write up”). • Simple integrity axiom A subject cannot read data from a lower integrity level (referred to as “no read down”). • Invocation property A subject cannot request service (invoke) to subjects of higher integrity. The name “simple integrity axiom” might sound a little goofy, but this rule protects the subject and data at a higher integrity level from being corrupted by data at a lower integrity level. This is all about trusting the source of the information. Another way to look at it is that trusted data are “clean” data and untrusted data (from a lower integrity level) are “dirty” data. Dirty data should not be mixed with clean data, because that could ruin the integrity of the clean data. The simple integrity axiom applies not only to subjects creating the data, but also to processes. A process of lower integrity should not be writing to trusted data of a higher integrity level. The areas of the different integrity levels are compartmentalized within the application that is based on the Biba model. An analogy would be if you were writing an article for The New York Times about the security trends over the last year, the amount of money businesses lost, and the cost/ benefit ratio of implementing firewalls, IDSs, and vulnerability scanners. You do not want to get your data and numbers from any old web site without knowing how those figures were calculated and the sources of the information. Your article (data at a higher integrity level) can be compromised if mixed with unfounded information from a bad source (data at a lower integrity level). When you are first learning about the Bell-LaPadula and Biba models, they may seem very similar, and the reasons for their differences may be somewhat confusing. The BellLaPadula model was written for the U.S. government, and the government is very paranoid about leakage of its secret information. In its model, a user cannot write to a lower level because that user might let out some secrets. Similarly, a user at a lower level cannot read anything at a higher level because that user might learn some secrets. However, not everyone is so worried about confidentiality and has such big important secrets to protect. The commercial industry is more concerned about the integrity of its data. An accounting firm is more worried about keeping its numbers straight and making sure decimal points are not dropped or extra zeroes are not added in a process carried out by an application. The accounting firm is more concerned about the integrity of these data and is usually under little threat of someone trying to steal these numbers, so the firm would use software that employs the Biba model. Of course, the accounting firm does not look for the name Biba on the back of a product or make sure it is in the design of its application. Which model to use is something that was decided upon and implemented when the application was being designed. The assurance ratings are what consumers use to determine if a system is right for them. So, even if the accountants are using an applica-
ch05.indd 337
10/5/2007 11:52:15 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
338 Bell-LaPadula vs. Biba The Bell-LaPadula model is used to provide confidentiality. The Biba model is used to provide integrity. The Bell-LaPadula and Biba models are informational flow models because they are most concerned about data flowing from one level to another. Bell-LaPadula uses security levels, and Biba uses integrity levels. It is important for CISSP test takers to know the rules of Biba and Bell-LaPadula. Their rules sound very similar: simple and *rules—one writing one way and one reading another way. A tip for how to remember them is that if the word “simple” is used, the rule is talking about reading. If the rule uses * or “star,” it is talking about writing. So now you just need to remember the reading and writing directions per model. tion that employs the Biba model, they would not necessarily know (and we’re not going to tell them). If you don’t have enough rules to understand so far, here’s another one. The invocation property in the Biba model states that a subject cannot invoke (call upon) a subject at a higher integrity level. Well, how is this different from the other two Biba rules? The *-integrity axiom (no write up) dictates how subjects can modify objects. The simple integrity axiom (no read down) dictates how subjects can read objects. The invocation property dictates how one subject can communicate with and initialize other subjects at run time. An example of a subject invoking another subject is when a process sends a request to a procedure to carry out some type of task. Subjects are only allowed to invoke tools at a lower integrity level. With the invocation property, the system is making sure a dirty subject cannot invoke a clean tool to contaminate a clean object.
References • Module 5, “Security Policies and Security Models” www.radium.ncsc.mil/ tpep/library/ramp-modules/mod_05.pdf • Security Models www.iwar.org.uk/comsec/resources/security-lecture/ showb1a7.html • Course study materials for Introduction to Security, University of Cambridge, Dr. Markus Kuhn, principal lecturer (academic year 2003–2004) www.cl.cam.ac.uk/Teaching/2003/IntroSecurity/slides.pdf • Chapter 3.3, “Models of OS Protection,” by Fred Cohen www.all.net/ books/ip/Chap3-3.html
The Clark-Wilson Model The Clark-Wilson model was developed after Biba and takes some different approaches to protecting the integrity of information. This model uses the following elements: • Users
Active agents
• Transformation procedures (TPs) Programmed abstract operations, such as read, write, and modify • Constrained data items (CDIs) Can be manipulated only by TPs
ch05.indd 338
10/5/2007 11:52:15 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
339 • Unconstrained data items (UDIs) Can be manipulated by users via primitive read and write operations • Integrity verification procedures (IVPs) Check the consistency of CDIs with external reality Although this list may look overwhelming, it is really quite straightforward. When an application uses the Clark-Wilson model, it separates data into one subset that needs to be highly protected, which is referred to as a constrained data item (CDI) and another subset that does not require a high level of protection, which is called an unconstrained data item (UDI). Users cannot modify critical data (CDI) directly. Instead, the subject (user) must be authenticated to a piece of software, and the software procedures (TPs) will carry out the operations on behalf of the user. For example, when Kathy needs to update information held within her company’s database, she will not be allowed to do so without a piece of software controlling these activities. First, Kathy must authenticate to a program, which is acting as a front end for the database, and then the program will control what Kathy can and cannot do to the information in the database. This is referred to as access triple: subject (user), program (TP), and object (CDI). A user cannot modify CDI without using a TP. So, Kathy is going to input data, which is supposed to overwrite some original data in the database. The software (TP) has to make sure this type of activity is secure and will carry out the write procedures for Kathy. Kathy (and any type of subject) is not trusted enough to manipulate objects directly. The CDI must have its integrity protected by the TPs. The UDI does not require such a high level of protection. For example, if Kathy did her banking online, the data on her bank’s servers and databases would be split into UDI and CDI categories. The CDI category would contain her banking account information, which needs to be highly protected. The UDI data could be her customer profile, which she can update as needed. TPs would not be required when Kathy needed to update her UDI information. In some cases, a system may need to change UDI data into CDI data. For example, when Kathy updates her customer profile via the web site to show her new correct address, this information will need to be moved into the banking software that is responsible for mailing out bank account information. The bank would not want Kathy to interact directly with that banking software, so a piece of software (TP) is responsible for copying that data and updating this customer’s mailing address. At this stage, the TP is changing the state of the UDI data to CDI. These concepts are shown in Figure 5-18. Remember that this is an integrity model, so it must have something that ensures that specific integrity rules are being carried out. This is the job of the IVP. The IVP ensures that all critical data (CDI) follows the application’s defined integrity rules. What usually turns people’s minds into spaghetti when they are first learning about models is that models are theoretical and abstract. Thus, when they ask the common question, “What are these defined integrity rules that the CDI must comply with?” they are told, “Whatever the vendor chooses them to be.” A model is made up of constructs, mathematical formulas, and other PhD kinds of stuff. The model provides the framework that can be used to build a certain characteristic into software (confidentiality, integrity, and so on). So the model does not stipu-
ch05.indd 339
10/5/2007 11:52:16 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
340
Figure 5-18 Subjects cannot modify CDI without using TP.
late what integrity rules the IVP must enforce; it just provides the framework, and the vendor chooses the integrity rules. The vendor implements integrity rules that its customer base needs the most. So if a vendor is developing an application for a financial institution, the UDI could be customer profiles that they are allowed to update and the CDI could be the bank account information, usually held on a mainframe. The UDI data do not need to be as highly protected and can be located on the same system or another system. A user can have access to UDI data without the use of a TP, but when the user needs to access CDI, they must use TP. So the vendor who develops the product will determine what type of data is considered UDI and what type of data is CDI and develop the TPs to control and orchestrate how the software enforces the integrity of the CDI values. In a banking application, the IVP would ensure that the CDI represents the correct value. For example, if Kathy has $2000 in her account and then deposits $50, the CDI for her account should now have a value of $2050. The IVP ensures the consistency of the data. So after Kathy carries out this transaction and the IVP validates the integrity of the CDI (new bank account value is correct), then the CDI is considered to be in a consistent state. TPs are the only components allowed to modify the state of the CDIs. In our example, TPs would be software procedures that carry out deposit, withdrawal, and transfer functionalities. Using TPs to modify CDIs is referred to as a well-formed transaction. A well-formed transaction is a series of operations that are carried out to transfer the data from one consistent state to the other. If Kathy transfers money from her checking account to her savings account, this transaction is made up of two operations: subtract money from one account and add it to a different account. By making sure the new values in her checking and savings accounts are accurate and their integrity is intact, the IVP maintains internal and external consistency. The Clark-Wilson model also outlines how to incorporate separation of duties into the architecture of an application. If we follow our same example of banking software, if a customer needs to withdraw over
ch05.indd 340
10/5/2007 11:52:16 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
341
$10,000, the application may require a supervisor to log in and authenticate this transaction. This is a countermeasure to potential fraudulent activities. The model provides the rules that the developers must follow to properly implement and enforce separation of duties through software procedures.
Goals of Integrity Models The following are the three main goals of integrity models: • Prevent unauthorized users from making modifications • Prevent authorized users from making improper modifications (separation of duties) • Maintain internal and external consistency (well-formed transaction) Clark-Wilson addresses each of these goals in its model. Biba only addresses the first goal. Internal and external consistency is provided by the IVP, which ensures that what is stored in the system as CDI properly maps to the input value that modified its state. So if Kathy has $2500 in her account and she withdraws $2000, the resulting value in the CDI is $500.
ch05.indd 341
10/5/2007 11:52:16 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
342 To summarize, the Clark-Wilson model enforces the three goals of integrity by using access triple (subject, software [TP], object), separation of duties, and auditing. This model enforces integrity by using well-formed transactions (through access triple) and separation of user duties. NOTE The access control matrix was covered in Chapter 4. This is another commonly used model in operating systems and applications.
The Information Flow Model Now, which way is the information flowing in this system? Response: Not to you. The Bell-LaPadula model focuses on preventing information from flowing from a high security level to a low security level. The Biba model focuses on preventing information from flowing from a low integrity level to a high integrity level. Both of these models were built upon the information flow model. Information flow models can deal with any kind of information flow, not only from one security (or integrity) level to another. In the information flow model, data are thought of as being held in individual and discrete compartments. In the Bell-LaPadula model, these compartments are based on security levels. Remember that MAC systems (which you learned about in Chapter 4) are based on the Bell-LaPadula model. MAC systems use labels on each subject and object. The subject’s label indicates the subject’s clearance and need to know. The object’s label indicates the object’s classification and categories. If you are in the army and have a top-secret clearance, this does not mean you can access all of the army’s top-secret information. Information is compartmentalized, based on two factors—classification and need to know. Your clearance has to dominate the object’s classification and your security profile must contain one of the categories listed in the object’s label, which enforces need to know. So Bell-LaPadula is an information flow model that ensures that information cannot flow from one compartment to another in a way that threatens the confidentiality of the data. Biba compartmentalizes data based on integrity levels. It is an information flow model that controls information flow in a way that is intended to protect the integrity of the most trusted information. How can information flow within a system? The answer is in many ways. Subjects can access files. Processes can access memory segments. When data are moved from the hard drive’s swap space into memory, information flows. Data are moved into and out of registers on a CPU. Data are moved into different cache memory storage devices. Data are written to the hard drive, thumb drive, CD-ROM drive, and so on. Properly controlling all of these ways of how information flows can be a very complex task. This is why the information flow model exists—to help architects and developers make sure their software does not allow information to flow in a way that can put the system or data in danger. One way that the information flow model provides this type of protection is by ensuring that covert channels do not exist in the code.
ch05.indd 342
10/5/2007 11:52:16 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
343 Covert Channels I have my decoder ring, cape, and pirate’s hat on. I will communicate to my spy buddies with this tribal drum and a whistle. A covert channel is a way for an entity to receive information in an unauthorized manner. It is an information flow that is not controlled by a security mechanism. This type of information path was not developed for communication; thus, the system does not properly protect this path, because the developers never envisioned information being passed in this way. Receiving information in this manner clearly violates the system’s security policy. The channel to transfer this unauthorized data is the result of one of the following conditions: • Improper oversight in the development of the product • Improper implementation of access controls within the software • Existence of a shared resource between the two entities Covert channels are of two types: storage and timing. In a covert storage channel, processes are able to communicate through some type of storage space on the system. For example, System A is infected with a Trojan horse that has installed software that will be able to communicate to another process in a limited way. System A has a very sensitive file (File 2) that is of great interest to a particular attacker. The software the Trojan horse installed is able to read this file and it needs to send the contents of the file to the attacker and it can only happen one bit at a time. The intrusive software is going to communicate to the attacker by locking a specific file (File 3). When the attacker attempts to access File 3 and finds it has a software lock enabled on it, the attacker interprets this to mean the first bit in the sensitive file is a 1. The second time the attacker attempts to access File 3 it is not locked. The attacker interprets this value to be zero. This continues until all of the data in the sensitive file are sent to the attacker. In this example, the software the Trojan Horse installed is the messenger. It can access the sensitive data and it uses another file that is on the hard drive to send signals to the attacker.
Other Types of Covert Channels Although we are looking at covert channels within programming code, covert channels can be used in the outside world as well. Let’s say you are going to attend one of my lectures. Before the lecture begins, you and I agree on a way of communicating that no one else in the audience will understand. I tell you that if I twiddle a pen between my fingers in my right hand, that means there will be a quiz at the end of class. If I twiddle a pen between my fingers in my left hand, there will be no quiz. It is a covert channel, because this is not a normal way of communicating and it is secretive. (In this scenario, I would twiddle the pen in both hands to confuse you and make you stay after class to take the quiz all by yourself. Shame on you for wanting to be forewarned about a quiz!)
ch05.indd 343
10/5/2007 11:52:17 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
344 Another way that a cover storage channel attack can take place is through file creation. A system has been compromised and has software that can create and delete files within a specific directory and has read access to a sensitive file. When the intrusive software sees that the first bit of the data within the sensitive file is 1, it will create a file named Temp in a specific directory. The attacker will try and create (or upload) a file with the exact same name and the attacker will receive a message indicating there is already a file with that name that exists in that directory. The attacker will know this means the first bit in the sensitive file is a 1. The attacker tries to create the same file again and when the system allows this it means the intrusive software on the system deleted that file, which means the second bit is a 0. Information flow models produce rules on how to ensure that covert channels do not exist. But there are many ways information flows within a system, so identifying and rooting out covert channels is usually more difficult than one would think at first glance. NOTE An overt channel is a channel of communication that was developed specifically for communication purposes. Processes should be communicating through overt channels, not covert channels. In a covert timing channel, one process relays information to another by modulating its use of system resources. The two processes that are communicating to each other are using the same shared resource, which is time. So in our example, Process A is a piece of nefarious software that was installed via a Trojan horse. In a multitasked system, each process is offered access to interact with the CPU. When this function is offered to Process A, it rejects it—which indicates a 1 to the attacker. The next time Process A is offered access to the CPU, it uses it, which indicates a 0 to the attacker. Think of this as a type of Morse code, but using some type of system resource. Countermeasures Because all operating systems have some type of covert channel, it is not always feasible to get rid of them all. The number of acceptable covert channels usually depends on the assurance rating of a system. A system that has a Common Criteria rating of EAL 6 has fewer covert channels than a system with an EAL rating of 3, because an EAL 6 rating represents a higher assurance level of providing a particular protection level when compared to the EAL 3 rating. There is not much a user can do to counteract these channels; instead, the channels must be addressed when the system is constructed and developed. NOTE In the Orange Book, covert channels in operating systems are not addressed until the security level B2 and above because these are the systems that would be holding data sensitive enough for others to go through all the necessary trouble to access data in this fashion.
References • “Secure Databases: An Analysis of Clark-Wilson Model in a Database Environment,” by Xiaocheng Ge, Fiona Polack, and Régine Laleau www-users.cs.york.ac.uk/~fiona/PUBS/CAiSE04.pdf • “Access Control: Theory and Practice” www.cs.purdue.edu/homes/ninghui/ courses/Fall03/lectures/lecture11_6.pdf
ch05.indd 344
10/5/2007 11:52:17 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
345 • “New Thinking About Information Technology Security,” by Marshall D. Abrams, PhD and Michael V. Joyce (first published in Computers & Security, Vol. 14, No. 1, pp. 57–68) www.acsac.org/secshelf/papers/new_thinking.pdf
The Noninterference Model Stop touching me. Stop touching me. You are interfering with me! Multilevel security properties can be expressed in many ways, one being noninterference. This concept is implemented to ensure any actions that take place at a higher security level do not affect, or interfere with, actions that take place at a lower level. This type of model does not concern itself with the flow of data, but rather with what a subject knows about the state of the system. So if an entity at a higher security level performs an action, it cannot change the state for the entity at the lower level. If a lower-level entity was aware of a certain activity that took place by an entity at a higher level and the state of the system changed for this lower-level entity, the entity might be able to deduce too much information about the activities of the higher state, which in turn is a way of leaking information. Users at a lower security level should not be aware of the commands executed by users at a higher level and should not be affected by those commands in any way. Let’s say that Tom and Kathy are both working on a multilevel mainframe at the same time. Tom has the security clearance of secret and Kathy has the security clearance of top secret. Since this is a central mainframe, the terminal Tom is working at has the context of secret, and Kathy is working at her own terminal, which has a context of top secret. This model states that nothing Kathy does at her terminal should directly or indirectly affect Tom’s domain (available resources and working environment). So whatever commands she executes or whichever resources she interacts with should not affect Tom’s experience of working with the mainframe in any way. This sounds simple enough, until you actually understand what this model is really saying. It seems very logical and straightforward that when Kathy executes a command, it should not affect Tom’s terminal. But the real intent of this model is to address covert channels and inference attacks. The model looks at the shared resources that the different users of a system will use and tries to identify how information can be passed from a process working at a higher security clearance to a process working at a lower security clearance. Since Tom and Kathy are working on the same system at the same time, they will most likely have to share some type of resources. So the model is made up of rules to ensure that Kathy cannot pass data to Tom through covert storage or timing channels. The other security breach this model addresses is the inference attack. An inference attack occurs when someone has access to some type of information and can infer (or guess) something that he does not have the clearance level or authority to know. For example, let’s say Tom is working on a file that contains information about supplies that are being sent to Russia. He closes out of that file and one hour later attempts to open the same file. During this time, this file’s classification has been elevated to top secret, so when Tom attempts to access it, he is denied. Tom can infer that some type of top-secret mission is getting ready to take place with Russia. He does not have clearance to know this, thus it would be an inference attack or “leaking information.” (Inference attacks are further explained in Chapter 11.)
ch05.indd 345
10/5/2007 11:52:17 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
346 The Lattice Model A lattice is a mathematical construct that is built upon the notion of a group. The most common definition of the lattice model is “a structure consisting of a finite partially ordered set together with least upper and greatest lower bound operators on the set.” Two things are wrong with this type of explanation. First, “a structure consisting of a finite partially ordered set together with least upper and greatest lower bound operators on the set” can only be understood by someone who understands the model in the first place. This is similar to the common definition of metadata: “data about data.” Only after you really understand what metadata are does this definition make any sense to you. So this definition of lattice model is not overly helpful. The problem with the mathematical explanation is that it is in weird alien writings that only people who obtain their master’s or PhD degree in mathematics can understand. This model needs to be explained in everyday language so even Homer Simpson can understand it. So let’s give it a try. The MAC model was explained in Chapter 4 and then built upon in this chapter. In this model, the subjects and objects have labels. Each subject’s label contains the clearance and need-to-know categories that this subject can access. Suppose Kathy’s security clearance is top secret and she has been formally granted access to the compartments named Iraq and Korea, based on her need to know. So Kathy’s security label states the following: TS {Iraq, Korea}. Table 5-1 shows the different files on the system in this scenario. The system is based on the MAC model, which means the operating system is making access decisions based on security label contents. Kathy attempts to access File B; since her clearance is greater than File B’s classification, she can read this file but not write to it. (Remember, under Bell-LaPadula, a higher-level subject can read down, but not write up). This is where the “partially ordered set together with least upper and greatest lower bound operators on the set” comes into play. A set is a subject (Kathy) and an object (file). It is a partially ordered set because all of the access controls are not completely equal. The system has to decide between read, write, full control, modify, and all the other types of access permissions used in this operating system. So, “partially ordered” means the system has to apply the most restrictive access controls to this set, and “least upper bound” means the system looks at one access control’s statement (Kathy can read the file) and the other access control’s statement (Kathy cannot write to the file) and takes the least upper bound value. Since no write is more restrictive than read, Kathy’s least upper bound access to this file is read and her greatest lower bound is no write. Figure 5-19 illustrates the bounds of access. This is just a confusing way of saying, “The most that Kathy can do with this file is read it. The least she can do is not write to it.” Kathy’s Security Label
File B’s Security Label
File C’s Security Label
File D’s Security Label
Top Secret {Iraq, Korea}
Secret {Iraq}
Top Secret {Iraq, Korea}
Secret {Iraq, Korea, Iran}
Table 5-1 Security Access Control Elements
ch05.indd 346
10/5/2007 11:52:18 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
347 Figure 5-19 Bounds of access through the lattice model
Let’s figure out the least upper bound and greatest lower bound access levels for Kathy and File C. Kathy’s clearance equals File C’s classification. Under the Bell-LaPadula model, this is when the strong star property would kick in. (Remember that the strong star property states that a subject can read and write to an object of the same security level.) So the least upper bound is write and the greatest lower bound is read. If we look at File D’s security label, we see it has a category that Kathy does not have in her security label, which is Iran. This means Kathy does not have the necessary need to know to be able to access this file. Kathy’s least upper bound and greatest lower bound access permission is no access. So why does this model state things in a very confusing way when in reality it describes pretty straightforward concepts? First, I am describing this model in the most simplistic and basic terms possible so you can get the basic meaning of the purpose of the model. These seemingly straightforward concepts build in complexity when you think about all the subject-to-object communications that go on within an operating system during any one second. Also, this is a formal model, which means it can be proven mathematically to provide a specific level of protection if all of its rules are followed properly. Learning these models is similar to learning the basics of chemistry. A student first learns about the components of an atom (protons, neutrons, and electrons) and how these elements interact with each other. This is the easy piece. Then the student gets into organic chemistry and has to understand how these components work together in complex organic systems (weak and strong attractions, osmosis, and ionization). The student then goes to quantum physics to learn that the individual elements of an atom actually have several different subatomic particles (quarks, leptons, and mesons). In this book, you are just learning the basic components of the models. Much more complexity lies under the covers.
ch05.indd 347
10/5/2007 11:52:18 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
348 The Brewer and Nash Model A wall separates our stuff so you can’t touch my stuff. Response: Your stuff is green and smells funny. I don’t want to touch it. The Brewer and Nash model, also called the Chinese Wall model, was created to provide access controls that can change dynamically depending upon a user’s previous actions. The main goal of the model is to protect against conflicts of interest by users’ access attempts. For example, if a large marketing company provides marketing promotions and materials for two banks, an employee working on a project for Bank A should not look at the information the marketing company has on its other bank customer, Bank B. Such action could create a conflict of interest because the banks are competitors. If the marketing company’s project manager for the Bank A project could view information on Bank B’s new marketing campaign, he may try to trump its promotion to please his more direct customer. The marketing company would get a bad reputation if it allowed its internal employees to behave so irresponsibly. This marketing company could implement a product that tracks the different marketing representatives’ access activities and disallows certain access requests that would present this type of conflict of interest. In Figure 5-20, we see that when a representative accesses Bank A’s information, the system automatically makes Bank B’s information off limits. If the representative accessed Bank B’s data, Bank A’s information would be off limits. These access controls change dynamically depending upon the user’s authorizations, activities, and previous access requests. The Chinese Wall model is also based on an information flow model. No information can flow between subjects and objects in a way that would result in a conflict of interest. The model states that a subject can write to an object if, and only if, the subject cannot read another object that is in a different dataset. So if we stay with our example, the project manager could not write to any objects within the Bank A dataset if he currently has read access to any objects in the Bank B dataset.
Figure 5-20 The Chinese Wall model provides dynamic access controls.
ch05.indd 348
10/5/2007 11:52:18 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
349 This is only one example of how this model can be used. Other industries will have their own possible conflicts of interest. If you were Martha’s stockbroker, you should not be able to read a dataset that indicates a stock’s price is getting ready to go down and be able to write to Martha’s account indicating she should sell the stock she has.
The Graham-Denning Model Remember that these are all models, thus they are not very specific in nature. Each individual vendor must decide upon how it is going to actually meet the rules outlined in the chosen model. Bell-LaPadula and Biba don’t define how the security and integrity ratings are defined and modified, nor do they provide a way to delegate or transfer access rights. The Graham-Denning model addresses these issues and defines a set of basic rights in terms of commands that a specific subject can execute on an object. This model has eight primitive protection rights, or rules of how these types of functionalities should take place securely, which are outlined next: • How to securely create an object • How to securely create a subject • How to securely delete an object • How to securely delete a subject • How to securely provide the read access right • How to securely provide the grant access right • How to securely provide the delete access right • How to securely provide transfer access rights These things may sound insignificant, but when building a secure system, they are critical.
The Harrison-Ruzzo-Ulman Model The Harrison-Ruzzo-Ulman model deals with access rights of subjects and the integrity of those rights. A subject can carry out only a finite set of operations on an object. Since security loves simplicity, it is easier for a system to allow or disallow authorization of operations if one command is restricted to a single operation. For example, if a subject sent command X which only required the operation of Y, this is pretty straightforward and allows the system to allow or disallow this operation to take place. But, if a subject sent a command M, and to fulfill that command, operations N, B, W, and P had to be carried out—there is much more complexity for the system to decide if this command should be authorized.
ch05.indd 349
10/5/2007 11:52:19 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
350 Security Models Recap All of these different models can get your head spinning. Most people are not familiar with all of them, which can make it all even harder to absorb. The following are the core concepts of the different models. • The Bell-LaPadula Model This confidentiality model describes the allowable information flows and formalizes the military security policy. It is the first mathematical model of a multilevel security policy that defines the concept of a secure state and necessary modes of access. • The simple security rule A subject cannot read data at a higher security level (no read up). • The *-property rule A subject cannot write data to an object at a lower security level (no write down). • The strong star property rule A subject can perform read and write functions only to the objects at its same security level. • The Biba Model This model protects the integrity of the information within a system and the activities that take place. It addresses the first goal of integrity. • The simple integrity axiom A subject cannot read data at a lower integrity level (no read down). • The *-integrity axiom A subject cannot modify an object in a higher integrity level (no write up). • The Clark-Wilson Model This integrity model is implemented to protect the integrity of data and to ensure that properly formatted transactions take place. It addresses all three goals of integrity. • Subjects can access objects only through authorized programs (access triple). • Separation of duties is enforced. • Auditing is required. • The Access Control Matrix Model This is a model in which access decisions are based on objects’ ACLs and subjects’ capability tables. • The Information Flow Model This is a model in which information is restricted in its flow to only go to and from entities in a way that does not negate the security policy. • The Noninterference Model This model states that commands and activities performed at one security level should not be seen by, or affect, subjects or objects at a different security level.
ch05.indd 350
10/5/2007 11:52:19 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
351 • The Brewer and Nash Model This model allows for dynamically changing access controls that protect against conflicts of interest. Also known as the Chinese Wall model. • The Graham-Denning Model This model shows how subjects and objects should be created and deleted. It also addresses how to assign specific access rights.
References • Various Papers on Models http://citeseer.ist.psu.edu/context/20585/0 • “A Lattice Model of Secure Information Flow,” by Dorothy E. Denning (first published in Communications of the ACM, Vol. 19, No. 5, pp. 236–243 (May 1976) www.cs.georgetown.edu/~denning/infosec/lattice76.pdf • Course syllabus for Security, University of Cambridge, Dr. Ross Anderson, principal lecturer (Jan. 1999) www.cl.cam.ac.uk/Teaching/1998/Security/ • Access Control and Security Policy Models www.tml.hut.fi/Opinnot/ T-110.402/2003/Luennot/titu20031024.pdf
Security Modes of Operation A system can operate in different modes depending on the sensitivity of the data being processed, the clearance level of the users, and what those users are authorized to do. The mode of operation describes the security conditions under which the system actually functions. These modes are used in MAC systems, which hold one or more classifications of data. Several things come into play when determining the mode the operating system should be working in: • The types of users who will be directly or indirectly connecting to the system • The type of data (classification levels, compartments, and categories) processed on the system • The clearance levels, need to know, and formal access approvals the users will have The following sections describe the different security modes that operating systems can be developed and configured to work in.
ch05.indd 351
10/5/2007 11:52:19 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
352 Dedicated Security Mode Our system only holds secret data and we can all access it. A system is operating in a dedicated security mode if all users have a clearance for, and a formal need to know about, all data processed within the system. All users have been given formal access approval for all information on the system and have signed nondisclosure agreements (NDAs) pertaining to this information. The system can handle a single classification level of information. Many military systems have been designed to handle only one level of security, which works in dedicated security mode. This requires everyone who uses the system to have the highest level of clearance required by any and all data on the system. If a system holds top-secret data, only users with that clearance can use the system. Other military systems work with multiple security levels, which is done by compartmentalizing the data. These types of systems can support users with high and low clearances simultaneously.
System High-Security Mode Our system only holds secret data, but only some of us can access all of it. A system is operating in system high-security mode when all users have a security clearance to access the information but not necessarily a need to know for all the information processed on the system. So, unlike in the dedicated security mode, in which all users have a need to know pertaining to all data on the system, in system high-security mode, all users have a need to know pertaining to some of the data. This mode also requires all users to have the highest level of clearance required by any and all data on the system. However, even though a user has the necessary security level to access an object, the user may still be restricted if he does not have a need to know pertaining to that specific object.
Compartmented Security Mode Our system has various classifications of data, and each individual has the clearance to access all of the data, but not necessarily the need to know. A system is operating in compartmented security mode when all users have the clearance to access all the information processed by the system in a system high-security configuration, but might not have the need to know and formal access approval. This means that if the system is holding secret and top-secret data, all users must have at least a top-secret clearance to gain access to this system. This is how compartmented and multilevel security modes are different. Both modes require the user to have a valid need to know, NDA, and formal approval, but compartmented security mode requires the user to have a clearance that dominates (above or equal to) any and all data on the system, whereas multilevel security mode just requires the user to have clearance to access the data she will be working with. In compartmented security mode, users are restricted from accessing some information because they do not need to access it to perform the functions of their jobs and they have not been given formal approval to access it. This would be enforced by having on all objects security labels that reflect the sensitivity (classification level, classification
ch05.indd 352
10/5/2007 11:52:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
353 category, and handling procedures) of the information. In this mode, users can access a compartment, of data only, enforced by mandatory access controls. The objective is to ensure that the minimum possible number of people learn of information at each level. Compartments are categories of data with a limited number of subjects cleared to access data at each level. Compartmented mode workstations (CMWs) enable users to process multiple compartments of data at the same time, if they have the necessary clearance.
Multilevel Security Mode Our system has various classifications of data, and each individual has the clearance and need to know to access only individual pieces of data. A system is operating in multilevel security mode when it permits two or more classification levels of information to be processed at the same time when not all of the users have the clearance or formal approval to access all the information being processed by the system. So all users must have formal approval, NDA, need to know, and the necessary clearance to access the data that they need to carry out their jobs. In this mode, the user cannot access all of the data on the system, only what she is cleared to access. The Bell-LaPadula model is an example of a multilevel security model because it handles multiple information classifications at a number of different security levels within one system simultaneously.
Guards Software and hardware guards allow the exchange of data between trusted (high assurance) and less trusted (low assurance) systems and environments. Let’s say you are working on a MAC system (working in dedicated security mode of secret) and you need the system to communicate with a MAC database (working in multilevel security mode, which goes up to top secret). These two systems provide different levels of protection. As previously stated, if a system with lower assurance could directly communicate with a system of higher assurance, then security vulnerabilities and compromises could be introduced. So, a software guard can be implemented, which is really just a front-end product that allows interconnectivity between systems working at different security levels. (The various types of guards available can carry out filtering, processing requests, data blocking, and data sanitization.) Or a hardware guard can be implemented, which is a system with two NICs connecting the two systems that need to communicate. The guard is an add-on piece that provides a level of strict access control between different systems. The guard accepts requests from the system of lower assurance, reviews the request to make sure it is allowed, and then submits the request to the system of higher assurance. The goal is to ensure that information does not flow from a high security level to a low security level in an unauthorized manner. Guards can be used to connect different MAC systems working in different security modes and to connect different networks working at different security levels. In many cases, the less trusted system can send messages to the more trusted system but can only receive acknowledgments in return. This is common when e-mail messages need to go from less trusted systems to more trusted classified systems.
ch05.indd 353
10/5/2007 11:52:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
354 Security Modes Recap Many times it is easier to understand these different modes when they are laid out in a clear and simplistic format. Pay attention to the words in italics because they emphasis the differences among the various modes. Dedicated Security Mode All users must have… • Proper clearance for all information on the system • Formal access approval for all information on the system • A signed NDA for all information on the system • A valid need to know for all information on the system • All users can access all data. System High-Security Mode All users must have… • Proper clearance for all information on the system • Formal access approval for all information on the system • A signed NDA for all information on the system • A valid need to know for some information on the system • All users can access some data, based on their need to know. Compartmented Security Mode
All users must have…
• Proper clearance for the highest level of data classification on the system • Formal access approval for all information they will access on the system • A signed NDA for all information they will access on the system • A valid need to know for some of the information on the system • All users can access some data, based on their need to know and formal access approval. Multilevel Security Mode All users must have… • Proper clearance for all information they will access on the system • Formal access approval for all information they will access on the system • A signed NDA for all information they will access on the system • A valid need to know for some of the information on the system • All users can access some data, based on their need to know, clearance, and formal access approval.
ch05.indd 354
10/5/2007 11:52:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
355 References • “Data Protection Measures” www.tpub.com/ans/51.htm • “Physical Model of Operations” chacs.nrl.navy.mil/publications/ CHACS/1997/jifi_web/node24.html • Chapter 8, “Automated Information System Security” http://nsi.org/ Library/Govt/Nispom.html#link8 • National Industrial Security Program Operating Manual (NISPOM), U.S. Department of Defense www.tscm.com/Nispom.html
Trust and Assurance I trust that you will act properly, thus I have a high level of assurance in you. Response: You are such a fool. As discussed earlier in the section “Trusted Computing Base,” no system is really secure because, with enough resources, attackers can compromise almost any system in one way or another; however, systems can provide levels of trust. The trust level tells the customer how much protection he can expect out of this system and the assurance that the system will act in a correct and predictable manner in each and every computing situation. The TCB comprises all the protection mechanisms within a system (software, hardware, firmware). All of these mechanisms need to work in an orchestrated way to enforce all the requirements of a security policy. When evaluated, these mechanisms are tested, their designs are inspected, and their supporting documentation is reviewed and evaluated. How the system is developed, maintained, and even delivered to the customer are all under review when the trust for a system is being gauged. All of these different components are put through an evaluation process and assigned an assurance rating, which represents the level of trust and assurance the testing team has in the product. Customers then use this rating to determine which system best fits their security needs. Assurance and trust are similar in nature, but slightly different with regard to product ratings. In a trusted system, all protection mechanisms work together to process sensitive data for many types of uses, and will provide the necessary level of protection per classification level. Assurance looks at the same issues but in more depth and detail. Systems that provide higher levels of assurance have been tested extensively and have had their designs thoroughly inspected, their development stages reviewed, and their technical specifications and test plans evaluated. You can buy a car and you can trust it, but you have a much deeper sense of assurance of that trust if you know how the car was built, what it was built with, who built it, what tests it was put through, and how it performed in many different situations. In the Trusted Computer Security Evaluation Criteria (TCSEC), commonly known as the Orange Book (addressed shortly), the lower assurance level ratings look at a system’s protection mechanisms and testing results to produce an assurance rating, but the higher assurance level ratings look more at the system design, specifications, devel-
ch05.indd 355
10/5/2007 11:52:20 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
356 opment procedures, supporting documentation, and testing results. The protection mechanisms in the higher assurance level systems may not necessarily be much different from those in the lower assurance level systems, but the way they were designed and built is under much more scrutiny. With this extra scrutiny comes higher levels of assurance of the trust that can be put into a system.
Systems Evaluation Methods A security evaluation examines the security-relevant parts of a system, meaning the TCB, access control mechanisms, reference monitor, kernel, and protection mechanisms. The relationship and interaction between these components are also evaluated. There are different methods of evaluating and assigning assurance levels to systems. Two reasons explain why more than one type of assurance evaluation process exists: methods and ideologies have evolved over time, and various parts of the world look at computer security differently and rate some aspects of security differently. Each method will be explained and compared.
Why Put a Product Through Evaluation? Submitting a product to be evaluated against the Orange Book, Information Technology Security Evaluation Criteria, or Common Criteria is no walk in the park for a vendor. In fact, it is a really painful and long process, and no one wakes up in the morning thinking, “Yippee! I have to complete all of the paperwork that the National Computer Security Center requires so my product can be evaluated!” So, before we go through these different criteria, let’s look at why anyone would even put themselves through this process. If you were going shopping to buy a firewall, how would you know what level of protection each provides and which is the best product for your environment? You could listen to the vendor’s marketing hype and believe the salesperson who informs you that a particular product will solve all of your life problems in one week. Or you could listen to the advice of an independent third party who has fully tested the product and does not have any bias toward the product. If you choose the second option, then you join a world of people who work within the realm of assurance ratings in one form or another. In the United States, the National Computer Security Center (NCSC) is an organization within the National Security Agency (NSA) that is responsible for evaluating computer systems and products. It has a group, Trusted Product Evaluation Program (TPEP), which oversees the testing by approved evaluation entities of commercial products against a specific set of criteria. So, a vendor creates a product and submits it to an approved evaluation entity that is compliant with the TPEP guidelines. The evaluation entity has groups of testers who will follow a set of criteria (for many years it was the Orange Book but now it is moving toward the Common Criteria) to test the vendor’s product. Once the testing is over, the product is assigned an assurance rating. So, instead of having to trust the marketing hype of the financially motivated vendor, you as a consumer can take the word of an objective third-party entity that fully tested the product.
ch05.indd 356
10/5/2007 11:52:21 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
357 This evaluation process is very time-consuming and expensive for the vendor. Not every vendor puts its product through this process, because of the expense and delayed date to get it to market. Typically, a vendor would put its product through this process if its main customer base will be making purchasing decisions based on assurance ratings. In the United States, the Department of Defense is the largest customer, so major vendors put their main products through this process with the hope that the Department of Defense (and others) will purchase their products.
The Orange Book The U.S. Department of Defense developed the Trusted Computer System Evaluation Criteria (TCSEC), which is used to evaluate operating systems, applications, and different products. These evaluation criteria are published in a book with an orange cover, which is called, appropriately, the Orange Book. (We like to keep things simple in security!) Customers use the assurance rating that the criteria present as a metric when comparing different products. It also provides direction for manufacturers so they know what specifications to build to, and provides a one-stop evaluation process so customers do not need to have individual components within the systems evaluated. The Orange Book is used to evaluate whether a product contains the security properties the vendor claims it does and whether the product is appropriate for a specific application or function. The Orange Book is used to review the functionality, effectiveness, and assurance of a product during its evaluation, and it uses classes that were devised to address typical patterns of security requirements. TCSEC provides a classification system that is divided into hierarchical divisions of assurance levels: A Verified protection B Mandatory protection C Discretionary protection D Minimal security Classification A represents the highest level of assurance and D represents the lowest level of assurance. Each division can have one or more numbered classes with a corresponding set of requirements that must be met for a system to achieve that particular rating. The classes with higher numbers offer a greater degree of trust and assurance. So B2 would offer more trust than B1, and C2 would offer more trust than C1. The criteria include four main topics—security policy, accountability, assurance, and documentation—but these actually break down into seven different areas: • Security policy The policy must be explicit and well defined and enforced by the mechanisms within the system. • Identification Individual subjects must be uniquely identified. • Labels Access control labels must be associated properly with objects. • Documentation Documentation must be provided, including test, design, and specification documents, user guides, and manuals.
ch05.indd 357
10/5/2007 11:52:21 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
358 • Accountability Audit data must be captured and protected to enforce accountability. • Life-cycle assurance Software, hardware, and firmware must be able to be tested individually to ensure that each enforces the security policy in an effective manner throughout their lifetimes. • Continuous protection The security mechanisms and the system as a whole must perform predictably and acceptably in different situations continuously. These categories are evaluated independently, but the rating assigned at the end does not specify these different objectives individually. The rating is a sum total of these items. Each division and class incorporates the requirements of the ones below it. This means that C2 must meet its criteria requirements and all of C1’s requirements, and B3 has its requirements to fulfill along with those of C1, C2, B1, and B2. Each division or class ups the ante on security requirements and is expected to fulfill the requirements of all the classes and divisions below it. So, when a vendor submits a product for evaluation, it submits it to the NCSC. The group that oversees the processes of evaluation is called the Trusted Products Evaluation Program (TPEP). Successfully evaluated products are placed on the Evaluated Products List (EPL) with their corresponding rating. When consumers are interested in certain products and systems, they can check the appropriate EPL to find out their assigned security levels.
Isn’t the Orange Book Dead? We are moving from the Orange Book to the Common Criteria in the industry, so a common question is, “Why do I have to study this Orange Book stuff?” Just because we are going through this transition, does not make the Orange Book unimportant. It was the first evaluation criteria and was used for 20 years. Many of the basic terms and concepts that have carried through originated in the Orange Book. And we still have several products with these ratings that eventually will go through the Common Criteria evaluation process. The CISSP exam is moving steadily from the Orange Book to the Common Criteria all the time, but don’t count the Orange Book out yet. As a follow-on observation, many people are new to the security field. It is a booming market, which means a flood of not-so-experienced people will be jumping in and attempting to charge forward without a real foundation of knowledge. To some readers, this book will just be a nice refresher and something that ties already known concepts together. To other readers, many of these concepts are new and more challenging. If a lot of this stuff is new to you—you are new to the market. That is okay, but knowing how we got where we are today is very beneficial because it broadens your view of deep understanding—instead of just memorizing for an exam.
ch05.indd 358
10/5/2007 11:52:21 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
359 Division D: Minimal Protection There is only one class in Division D. It is reserved for systems that have been evaluated but fail to meet the criteria and requirements of the higher divisions.
Division C: Discretionary Protection The C rating category has two individual assurance ratings within it, which are described next. The higher the number of the assurance rating, the greater the protection. C1: Discretionary Security Protection Discretionary access control is based on individuals and/or groups. It requires a separation of users and information, and identification and authentication of individual entities. Some type of access control is necessary so users can ensure their data will not be accessed and corrupted by others. The system architecture must supply a protected execution domain so privileged system processes are not adversely affected by lower-privileged processes. There must be specific ways of validating the system’s operational integrity. The documentation requirements include design documentation, which shows that the system was built to include protection mechanisms, test documentation (test plan and results), a facility manual, so companies know how to install and configure the system correctly, and user manuals. The type of environment that would require this rating is one in which users are processing information at the same sensitivity level; thus, strict access control and auditing measures are not required. It would be a trusted environment with low security concerns. C2: Controlled Access Protection Users need to be identified individually to provide more precise access control and auditing functionality. Logical access control mechanisms are used to enforce authentication and the uniqueness of each individual’s identification. Security-relevant events are audited, and these records must be protected from unauthorized modification. The architecture must provide resource, or object, isolation so proper protection can be applied to the resource and any actions taken upon it can be properly audited. The object reuse concept must also be invoked, meaning that any medium holding data must not contain any remnants of information after it is released for another subject to use. If a subject uses a segment of memory, that memory space must not hold any information after the subject is done using it. The same is true for storage media, objects being populated, and temporary files being created—all data must be efficiently erased once the subject is done with that medium. This class requires a more granular method of providing access control. The system must enforce strict logon procedures and provide decision-making capabilities when subjects request access to objects. A C2 system cannot guarantee it will not be compromised, but it supplies a level of protection that would make attempts to compromise it harder to accomplish. The type of environment that would require systems with a C2 rating is one in which users are trusted but a certain level of accountability is required. C2, overall, is seen as the most reasonable class for commercial applications, but the level of protection is still relatively weak.
ch05.indd 359
10/5/2007 11:52:21 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
360 Division B: Mandatory Protection Mandatory access control is enforced by the use of security labels. The architecture is based on the Bell-LaPadula security model, and evidence of reference monitor enforcement must be available. B1: Labeled Security Each data object must contain a classification label and each subject must have a clearance label. When a subject attempts to access an object, the system must compare the subject’s and object’s security labels to ensure the requested actions are acceptable. Data leaving the system must also contain an accurate security label. The security policy is based on an informal statement, and the design specifications are reviewed and verified. This security rating is intended for environments that require systems to handle classified data. NOTE Security labels are not required until security rating B; thus, C2 does not require security labels but B1 does.
B2: Structured Protection The security policy is clearly defined and documented, and the system design and implementation are subjected to more thorough review and testing procedures. This class requires more stringent authentication mechanisms and well-defined interfaces among layers. Subjects and devices require labels, and the system must not allow covert channels. A trusted path for logon and authentication processes must be in place, which means the subject communicates directly with the application or operating system, and no trapdoors exist. There is no way to circumvent or compromise this communication channel. Operator and administration functions are separated within the system to provide more trusted and protected operational functionality. Distinct address spaces must be provided to isolate processes, and a covert channel analysis is conducted. This class adds assurance by adding requirements to the design of the system. The type of environment that would require B2 systems is one that processes sensitive data that require a higher degree of security. This type of environment would require systems that are relatively resistant to penetration and compromise. B3: Security Domains In this class, more granularity is provided in each protection mechanism, and the programming code that is not necessary to support the security policy is excluded. The design and implementation should not provide too much complexity, because as the complexity of a system increases, so must the skill level of the individuals who need to test, maintain, and configure it; thus, the overall security can be threatened. The reference monitor components must be small enough to test properly and be tamperproof. The security administrator role is clearly defined, and the system must be able to recover from failures without its security level being compromised. When the system starts up and loads its operating system and components, it must be done in an initial secure state to ensure that any weakness of the system cannot be taken advantage of in this slice of time.
ch05.indd 360
10/5/2007 11:52:22 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
361 The type of environment that requires B3 systems is a highly secured environment that processes very sensitive information. It requires systems that are highly resistant to penetration.
Division A: Verified Protection Formal methods are used to ensure that all subjects and objects are controlled with the necessary discretionary and mandatory access controls. The design, development, implementation, and documentation are looked at in a formal and detailed way. The security mechanisms between B3 and A1 are not very different, but the way the system was designed and developed is evaluated in a much more structured and stringent procedure. A1: Verified Design The architecture and protection features are not much different from systems that achieve a B3 rating, but the assurance of an A1 system is higher than a B3 system because of the formality in the way the A1 system was designed, the way the specifications were developed, and the level of detail in the verification techniques. Formal techniques are used to prove the equivalence between the TCB specifications and the security policy model. A more stringent change configuration is put in place with the development of an A1 system, and the overall design can be verified. In many cases, even the way in which the system is delivered to the customer is under scrutiny to ensure there is no way of compromising the system before it reaches its destination. The type of environment that would require A1 systems is the most secure of secured environments. This type of environment deals with top-secret information and cannot adequately trust anyone using the systems without strict authentication, restrictions, and auditing. NOTE TCSEC addresses confidentiality, but not integrity. Functionality of the security mechanisms and the assurance of those mechanisms are not evaluated separately, but rather are combined and rated as a whole.
References • Trusted Computer System Evaluation Criteria (Orange Book), U.S. Department of Defense (Dec. 26, 1985) www.boran.com/security/ tcsec.html • Lecture notes for Cryptography and Network Security, Part 7, “Trusted Computer Systems,” William Stallings, lecturer, Dr. Lawrie Brown, author www. williamstallings.com/Extras/Security-Notes/lectures/ trusted.html
The Orange Book and the Rainbow Series Why are there so many colors in the rainbow? Response: Because there are so many product types that need to be evaluated. The Orange Book mainly addresses government and military requirements and expectations for their computer systems. Many people within the security field have pointed out several deficiencies in the Orange Book, particularly when it is being
ch05.indd 361
10/5/2007 11:52:22 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
362 applied to systems that are to be used in commercial areas instead of government organizations. The following list summarizes a majority of the troubling issues that security practitioners have expressed about the Orange Book: • It looks specifically at the operating system and not at other issues like networking, databases, and so on. • It focuses mainly on one attribute of security—confidentiality—and not on integrity and availability. • It works with government classifications and not the protection classifications commercial industries use. • It has a relatively small number of ratings, which means many different aspects of security are not evaluated and rated independently. The Orange Book places great emphasis on controlling which users can access a system and virtually ignores controlling what those users do with the information once they are authorized. Authorized users can, and usually do, cause more damage to data than outside attackers. Commercial organizations have expressed more concern about the integrity of their data, whereas military organizations stress that their top concern is confidentiality. Because of these different goals, the Orange Book is a better evaluation tool for government and military systems. Because the Orange Book focuses on the operating system, many other areas of security were left out. The Orange Book provides a broad framework for building and evaluating trusted systems, but it leaves many questions about topics other than operating systems unanswered. So, more books were written to extend the coverage of the Orange Book into other areas of security. These books provide detailed information and interpretations of certain Orange Book requirements and describe the evaluation processes. These books are collectively called the Rainbow Series because the cover of each is a different color. For an explanation of each book and its usage, please refer to the following references.
References • Rainbow Series www.csrc.ncsl.nist.gov/secpubs/rainbow/ • Rainbow Series and related documents from the Federation of American Scientists www.fas.org/irp/nsa/rainbow.htm
The Red Book The Orange Book addresses single-system security, but networks are a combination of systems, and each network needs to be secure without having to fully trust each and every system connected to it. The Trusted Network Interpretation (TNI), also called the Red Book because of the color of its cover, addresses security evaluation topics for networks and network components. It addresses isolated local area networks and wide area internetwork systems.
ch05.indd 362
10/5/2007 11:52:22 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
363 Like the Orange Book, the Red Book does not supply specific details about how to implement security mechanisms. Instead, it provides a framework for securing different types of networks. A network has a security policy, architecture, and design, as does an operating system. Subjects accessing objects on the network need to be controlled, monitored, and audited. In a network, the subject could be a workstation and an object could be a network service on a server. The Red Book rates confidentiality of data and operations that happen within a network and the network products. Data and labels need to be protected from unauthorized modification, and the integrity of information as it is transferred needs to be ensured. The source and destination mechanisms used for messages are evaluated and tested to ensure modification is not allowed. Encryption and protocols are components that provide a lot of the security within a network, and the Red Book measures their functionality, strength, and assurance. The following is a brief overview of the security items addressed in the Red Book: • Communication integrity • Authentication Protects against masquerading and playback attacks. Mechanisms include digital signatures, encryption, timestamp, and passwords. • Message integrity Protects the protocol header, routing information, and packet payload from being modified. Mechanisms include message authentication and encryption. • Nonrepudiation Ensures that a sender cannot deny sending a message. Mechanisms include encryption, digital signatures, and notarization. • Denial-of-Service prevention • Continuity of operations Ensures that the network is available even if attacked. Mechanisms include fault-tolerant and redundant systems and the capability to reconfigure network parameters in case of an emergency. • Network management Monitors network performance and identifies attacks and failures. Mechanisms include components that enable network administrators to monitor and restrict resource access. • Compromise protection • Data confidentiality Protects data from being accessed in an unauthorized method during transmission. Mechanisms include access controls, encryption, and physical protection of cables. • Traffic flow confidentiality Ensures that unauthorized entities are not aware of routing information or frequency of communication via traffic analysis. Mechanisms include padding messages, sending noise, or sending false messages. • Selective routing Routes messages in a way to avoid specific threats. Mechanisms include network configuration and routing tables.
ch05.indd 363
10/5/2007 11:52:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
364 Assurance is derived by comparing how things actually work to a theory of how things should work. Assurance is also derived by testing configurations in many different scenarios, evaluating engineering practices, and validating and verifying security claims. TCSEC was introduced in 1985 and retired in December 2000. It was the first methodical and logical set of standards developed to secure computer systems. It was greatly influential to several countries that based their evaluation standards on the TCSEC guidelines. TCSEC was finally replaced with the Common Criteria.
Information Technology Security Evaluation Criteria The Information Technology Security Evaluation Criteria (ITSEC) was the first attempt at establishing a single standard for evaluating security attributes of computer systems and products by many European countries. The United States looked to the Orange Book and Rainbow Series, and Europe employed ITSEC to evaluate and rate computer systems. (Today, everyone is migrating to the Common Criteria, explained in the next section.) ITSEC evaluates two main attributes of a system’s protection mechanisms: functionality and assurance. When the functionality of a system’s protection mechanisms is being evaluated, the services that are provided to the subjects (access control mechanisms, auditing, authentication, and so on) are examined and measured. Protection mechanism functionality can be very diverse in nature because systems are developed differently just to provide different functionality to users. Nonetheless, when functionality is evaluated, it is tested to see if the system’s protection mechanisms deliver what its vendor says they deliver. Assurance, on the other hand, is the degree of confidence in the protection mechanisms, and their effectiveness and capability to perform consistently. Assurance is generally tested by examining development practices, documentation, configuration management, and testing mechanisms. It is possible for two systems’ protection mechanisms to provide the same type of functionalities and have very different assurance levels. This is because the underlying mechanisms providing the functionality can be developed, engineered, and implemented differently. System A and System B may have protection mechanisms that provide the same type of functionality for authentication, in which case both products would get the same rating for functionality. But System A’s developers could have been sloppy and careless when developing their authentication mechanism, in which case their product would receive a lower assurance rating. ITSEC actually separates these two attributes (functionality and assurance) and rates them separately, whereas TCSEC clumps them together and assigns them one rating (D through A1). The following list shows the different types of functionalities and assurance items tested during an evaluation. • • • • •
ch05.indd 364
Security functional requirements Identification and authentication Audit Resource utilization Trusted paths/channels
10/5/2007 11:52:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
365 • User data protection • Security management • Product access • Communications • Privacy • Protection of the product’s security functions • Cryptographic support • Security assurance requirements • Guidance documents and manuals • Configuration management • Vulnerability assessment • Delivery and operation • Life-cycle support • Assurance maintenance • Development • Testing Consider again our example of two systems that provide the same functionality (pertaining to the protection mechanisms) but have very different assurance levels. Using the TCSEC approach, the difference in assurance levels will be hard to distinguish because the functionality and assurance level are rated together. Under the ITSEC approach, the functionality is rated separately from the assurance, so the difference in assurance levels will be more noticeable. In the ITSEC criteria, classes F1 to F10 rate the functionality of the security mechanisms, whereas E0 to E6 rate the assurance of those mechanisms. So a difference between ITSEC and TCSEC is that TCSEC bundles functionality and assurance into one rating, whereas ITSEC evaluates these two attributes separately. The other differences are that ITSEC was developed to provide more flexibility than TCSEC, and ITSEC addresses integrity, availability, and confidentiality, whereas TCSEC addresses only confidentiality. ITSEC also addresses networked systems, whereas TCSEC deals with stand-alone systems. Table 5-2 is a general mapping of the two evaluation schemes to show you their relationship to each other. As you can see, a majority of the ITSEC ratings can be mapped to the Orange Book ratings, but then ITSEC took a step farther and added F6 through F10 for specific needs consumers might have that the Orange Book does not address. ITSEC is criteria for operating systems and other products, which it refers to individually as the target of evaluation (TOE). So if you are reading literature discussing the ITSEC rating of a product and it states the TOE has a rating of F1 and E5, you know the TOE is the product that was evaluated and that it has a low functionality rating and a high assurance rating.
ch05.indd 365
10/5/2007 11:52:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
366 ITSEC
TCSEC
E0
=D
F1 + E1
= C1
F2 + E2
= C2
F3 + E3
= B1
F4 + E4
= B2
F5 + E5
= B3
F5 + E6
= A1
F6
= Systems that provide high integrity
F7
= Systems that provide high availability
F8
= Systems that provide data integrity during communication
F9
= Systems that provide high confidentiality (like cryptographic devices)
F10
= Networks with high demands on confidentiality and integrity
Table 5-2 ITSEC and TCSEC Mapping
The ratings pertain to assurance, which is the correctness and effectiveness of the security mechanism, and functionality. Functionality is viewed in terms of the system's security objectives, security functions, and security mechnisms. The following are some examples of the functionalities that are tested: identification and authentication, access control, accountability, auditing, object reuse, accuracy, reliability of service, and data exchange.
References • Criteria and Methods of Evaluations of Information Systems www.cordis .lu/infosec/src/crit.htm • ITSEC home page www.iwar.org.uk/comsec/resources/standards/itsec.htm
Common Criteria “TCSEC is too hard, ITSEC is too soft, but the Common Criteria is just right,” said the baby bear. The Orange Book and the Rainbow Series provide evaluation schemes that are too rigid for the business world. ITSEC attempted to provide a more flexible approach by separating the functionality and assurance attributes and considering the evaluation of entire systems. However, this flexibility added complexity because evaluators could mix and match functionality and assurance ratings, which resulted in too many classifications to keep straight. Because we are a species that continues to try to get it right, the next attempt for an effective and usable evaluation criteria was the Common Criteria.
ch05.indd 366
10/5/2007 11:52:23 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
367 In 1990, the International Organization for Standardization (ISO) identified the need of international standard evaluation criteria to be used globally. The Common Criteria project started in 1993 when several organizations came together to combine and align existing and emerging evaluation criteria (TCSEC, ITSEC, Canadian Trusted Computer Product Evaluation Criteria [CTCPEC], and the Federal Criteria). The Common Criteria was developed through a collaboration among national security standards organizations within the United States, Canada, France, Germany, the United Kingdom, and the Netherlands. The benefit of having a globally recognized and accepted set of criteria is that it helps consumers by reducing the complexity of the ratings and eliminating the need to understand the definition and meaning of different ratings within various evaluation schemes. This also helps manufacturers, because now they can build to one specific set of requirements if they want to sell their products internationally, instead of having to meet several different ratings with varying rules and requirements. The Orange Book evaluates all systems by how they compare to the Bell-LaPadula model. The Common Criteria provides more flexibility by evaluating a product against a protection profile, which is structured to address a real-world security need. So while the Orange Book says, “Everyone march in this direction in this form using this path,” the Common Criteria asks, “Okay, what are the threats we are facing today and what are the best ways of battling them?” Under the Common Criteria model, an evaluation is carried out on a product and is assigned an Evaluation Assurance Level (EAL). The thorough and stringent testing increases in detailed-oriented tasks as the assurance levels increase. The Common Criteria has seven assurance levels. The range is from EAL1, where functionality testing takes place, to EAL7, where thorough testing is performed and the system design is verified. The different EAL packages are listed next: • EAL1 Functionally tested • EAL2 Structurally tested • EAL3 Methodically tested and checked • EAL4 Methodically designed, tested, and reviewed • EAL5 Semiformally designed and tested • EAL6 Semiformally verified design and tested • EAL7 Formally verified design and tested NOTE When a system is “formally verified” this means it is based on a model that can be mathematically proven. The Common Criteria uses protection profiles in its evaluation process. This is a mechanism used to describe a real-world need of a product that is not currently on the market. The protection profile contains the set of security requirements, their meaning
ch05.indd 367
10/5/2007 11:52:24 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
368 and reasoning, and the corresponding EAL rating that the intended product will require. The protection profile describes the environmental assumptions, the objectives, and the functional and assurance level expectations. Each relevant threat is listed along with how it is to be controlled by specific objectives. The protection profile also justifies the assurance level and requirements for the strength of each protection mechanism. The protection profile provides a means for a consumer, or others, to identify specific security needs; this is the security problem to be conquered. If someone identifies a security need that is not currently being addressed by any current product, that person can write a protection profile describing the product that would be a solution for this real-world problem. The protection profile goes on to provide the necessary goals and protection mechanisms to achieve the required level of security, as well as a list of things that could go wrong during this type of system development. This list is used by the engineers who develop the system, and then by the evaluators to make sure the engineers dotted every i and crossed every t. The Common Criteria was developed to stick to evaluation classes but also to retain some degree of flexibility. Protection profiles were developed to describe the functionality, assurance, description, and rationale of the product requirements. Like other evaluation criteria before it, the Common Criteria works to answer two basic questions about products being evaluated: what does its security mechanisms do (functionality), and how sure are you of that (assurance)? This system sets up a framework that enables consumers to clearly specify their security issues and problems; developers to specify their security solution to those problems; and evaluators to unequivocally determine what the product actually accomplishes. A protection profile contains the following five sections: • Descriptive elements Provides the name of the profile and a description of the security problem to be solved. • Rationale Justifies the profile and gives a more detailed description of the real-world problem to be solved. The environment, usage assumptions, and threats are illustrated along with guidance on the security policies that can be supported by products and systems that conform to this profile. • Functional requirements Establishes a protection boundary, meaning the threats or compromises within this boundary to be countered. The product or system must enforce the boundary established in this section. • Development assurance requirements Identifies the specific requirements the product or system must meet during the development phases, from design to implementation. • Evaluation assurance requirements Establishes the type and intensity of the evaluation.
ch05.indd 368
10/5/2007 11:52:24 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
369 The evaluation process is just one leg of determining the functionality and assurance of a product. Once a product achieves a specific rating, it only applies to that particular version and only to certain configurations of that product. So if a company buys a firewall product because it has a high assurance rating, the company has no guarantee the next version of that software will have that rating. The next version will need to go through its own evaluation review. If this same company buys the firewall product and installs it with configurations that are not recommended, the level of security the company was hoping to achieve can easily go down the drain. So, all of this rating stuff is a formalized method of reviewing a system being evaluated in a lab. When the product is implemented in a real environment, factors other than its rating need to be addressed and assessed to ensure it is properly protecting resources and the environment. NOTE When a product is assigned an assurance rating, this means it has the potential of providing this level of protection. The customer has to properly configure the product to actually obtain this level of security. The vendor should provide the necessary configuration documentation, and it is up to the customer to keep the product properly configured at all times.
References • Computer Security Resource Center (CSRC) Common Criteria for IT Security Evaluation csrc.nist.gov/cc/ • Common Criteria www.commoncriteriaportal.org/public/files/ ccintroduction.pdf • Common Criteria overview, Rycombe Consulting www.rycombe.com/cc.htm
Certification vs. Accreditation We have gone through the different types of evaluation criteria that a system can be appraised against to receive a specific rating. This is a very formalized process, following which the evaluated system or product will be placed on an EPL indicating what rating it achieved. Consumers can check this listing and compare the different products and systems to see how they rank against each other in the property of protection. However, once a consumer buys this product and sets it up in their environment, security is not guaranteed. Security is made up of system administration, physical security, installation, and configuration mechanisms within the environment, and other security issues. To fairly say a system is secure, all of these items must be taken into account. The rating is just one piece in the puzzle of security.
ch05.indd 369
10/5/2007 11:52:24 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
370 Different Components of the Common Criteria The different components of the Common Criteria are shown and described next:
• Protection profile Description of a needed security solution. • Target of evaluation Product proposed to provide a needed security solution. • Security target Vendor’s written explanation of the security functionality and assurance mechanisms that meet the needed security solution—in other words, “This is what our product does and how it does it.” • Packages—EALs Functional and assurance requirements are bundled into packages for reuse. This component describes what must be met to achieve specific EAL ratings.
Certification How did you certify this product? Response: It came in a very pretty box. Let’s keep it. Certification is the comprehensive technical evaluation of the security components and their compliance for the purpose of accreditation. A certification process may use
ch05.indd 370
10/5/2007 11:52:25 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
371 safeguard evaluation, risk analysis, verification, testing, and auditing techniques to assess the appropriateness of a specific system. For example, suppose Dan is the security officer for a company that just purchased new systems to be used to process its confidential data. He wants to know if these systems are appropriate for these tasks and if they are going to provide the necessary level of protection. He also wants to make sure they are compatible with his current environment, do not reduce productivity, and do not open doors to new threats—basically, he wants to know if these are the right products for his company. He could pay a company that specializes in these matters to perform the necessary procedures to certify the systems, or it can be carried out internally. The evaluation team will perform tests on the software configurations, hardware, firmware, design, implementation, system procedures, and physical and communication controls. The goal of a certification process is to ensure that a system, product, or network is right for the customer’s purposes. Customers will rely upon a product for slightly different reasons, and environments will have various threat levels. So a particular product is not necessarily the best fit for every single customer out there. (Of course, vendors will try to convince you otherwise.) The product has to provide the right functionality and security for the individual customer, which is the whole purpose of a certification process. The certification process and corresponding documentation will indicate the good, the bad, and the ugly about the product and how it works within the given environment. Dan will take these results and present them to his management for the accreditation process.
Accreditation Accreditation is the formal acceptance of the adequacy of a system’s overall security and functionality by management. The certification information is presented to management, or the responsible body, and it is up to management to ask questions, review the reports and findings, and decide whether to accept the product and whether any corrective action needs to take place. Once satisfied with the system’s overall security as presented, management makes a formal accreditation statement. By doing this, management is stating it understands the level of protection the system will provide in its current environment and understands the security risks associated with installing and maintaining this system.
No More Pencil Whipping Many organizations are taking the accreditation process more seriously than they did in the past. Unfortunately, sometimes when a certification process is completed and the documentation is sent to management for review and approval, management members just blindly sign the necessary documentation without really understanding what they are signing. Accreditation means management is accepting the risk that is associated with allowing this new product to be introduced into the organization’s environment. When large security compromises take place, the buck stops at the individual who signed off on the offending item. So as these management members are being held more accountable for what they sign off on and as more regulations make executives personally responsible for security, the pencil whipping of accreditation papers is decreasing, but has not stopped.
ch05.indd 371
10/5/2007 11:52:25 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
372 NOTE Certification is a technical review that assesses the security mechanisms and evaluates their effectiveness. Accreditation is management’s official acceptance of the information in the certification process findings. Because software, systems, and environments continually change and evolve, the certification and accreditation should also continue to take place. Any major addition of software, changes to the system, or modification of the environment should initiate a new certification and accreditation cycle.
Open vs. Closed Systems Computer systems can be developed to integrate easily with other systems and products (open systems) or can be developed to be more proprietary in nature and work with only a subset of other systems and products (closed systems). The following sections describe the difference between these approaches.
Open Systems I want to be able to work and play well with others. Response: But no one wants to play with you. Systems described as open are built upon standards, protocols, and interfaces that have published specifications, which enable third-party vendors to develop add-on components and devices. This type of architecture provides interoperability between products created by different vendors. This interoperability is provided by all the vendors involved who follow specific standards and provide interfaces that enable each system to easily communicate with other systems and allow add-ons to hook into the system easily. A majority of the systems in use today are open systems. The reason an administrator can have Windows XP, Windows 2000, Macintosh, and Unix computers communicating easily on the same network is because these platforms are open. If a software vendor creates a closed system, it is restricting its potential sales to proprietary environments. NOTE In Chapter 11, we will look at the standards that support interoperability, including CORBA, DCOM, J2EE, and more.
Closed Systems I only want to play with you and him. Response: Just play with him. Systems referred to as closed use an architecture that does not follow industry standards. Interoperability and standard interfaces are not employed to enable easy communication between different types of systems and add-on features. Closed systems are proprietary, meaning the system can only communicate with like systems. A closed architecture can provide more security to the system because it does not have as many doorways in, and it operates in a more secluded environment than open
ch05.indd 372
10/5/2007 11:52:25 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
373 environments. Because a closed system is proprietary, there are not as many tools to thwart the security mechanisms and not as many people who understand its design, language, and security weaknesses and thus exploit them. A majority of the systems today are built with open architecture to enable them to work with other types of systems, easily share information, and take advantage of the functionality that third-party add-ons bring. However, this opens the doors to more hacks, cracks, and attacks. You can’t have your cake and eat it too it seems.
Enterprise Architecture Up until now we have covered many operating system and application items and concepts. We started with the architecture of a system and went through the many components that must be securely built in to help ensure the necessary level of protection required from it. The system security architecture is a high-level design that works as a framework. The architecture lays out what needs to be in place to ensure that the system’s security policy and protection level are met. Great, so what is an enterprise security architecture? Organizations have a choice when attempting to secure their environment as a whole. They can just toss in products here and there, which are referred to as point solutions or stovepipe solutions, and hope the ad hoc approach magically works in a manner that secures the environment evenly and covers all of the enterprise’s vulnerabilities. Or the organization can take the time to understand the environment, understand the security requirements of the business and environment, and lay out an overarching framework and strategy that maps the two together. Most organizations choose option one, which is the “constantly putting out fires” approach. This is a lovely way to keep stress levels elevated, security requirements unmet, and to let confusion and chaos be the norm. The second approach would be to define an enterprise security architecture, allow it to be the guide when implementing solutions to ensure needs are met, provide standard protection across the environment, and reduce the amount of security surprises the organization will run into. Although implementing an enterprise security architecture will not necessarily promise pure utopia, it does tame the chaos and gets the security staff, and organization, into a more proactive and mature mindset when dealing with security as a whole. An enterprise security architecture defines the information security strategy that consists of layers of policy, standards, solutions, and procedures and the way they are linked across an enterprise strategically, tactically, and operationally. This is different than the infrastructure architecture. Infrastructure is the underlying technology and hardware needed to support the enterprise security architecture. So basically you can have an infrastructure (switches, cables, routers, nodes, and so on), but it requires the software, people, and processes to work together in a cohesive and secure manner to have an actual enterprise architecture. Besides security, this type of architecture allows organizations to better achieve interoperability, integration, ease-of-use, standardization, and governance.
ch05.indd 373
10/5/2007 11:52:26 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
374 How do you know if an organization does not have an enterprise security architecture in place? If the answer is “yes” to most of the following questions, this type of architecture is not in place. • Does identifying new vulnerabilities and exposures take more than 15 days? • When user access requirements increase because of business needs, does the security or network administrator just modify the access controls without the user manager’s documented approval? • When rolling out a new product, do unexpected interoperability issues pop up which require more time and money to fix? • Do many “one-off” efforts take place instead of following standardized procedures when security issues arise? • Are the business unit managers unaware of their security responsibilities and how their responsibilities map to legal and regulatory requirements? • Is “sensitive data” defined in a policy, but the necessary controls are not fully implemented and monitored? • Are stovepipe (point) solutions implemented instead of enterprise-wide solutions? • Are the same expensive mistakes continuing to take place? • Is there a continual disconnect between senior management and the security staff? • Is security governance currently unavailable because the enterprise is not viewed or monitored in a standardized and holistic manner? • Are business decisions made without taking security into account? • Are security personnel usually putting out fires with no real time to look at and develop strategic approaches? • Are more and more security personnel seeking out shrinks and going on antidepressant or anti-anxiety medication? If many of these answers are “yes,” no useful architecture is in place. Now, the following is something very interesting the author has seen over several years. Most organizations have the problems listed earlier and yet they focus on each item as if they were unconnected. What the CSO, CISO, and/or security administrator do not understand is that these are just symptoms of a treatable disease. The “treatment” is to put one person in charge of a team that develops a phased-approach enterprise security architecture rollout plan. The goals are to shift from technology-oriented to business-centric security processes, link administrative, technical, and physical controls to properly manage risk, and integrate these processes into the IT infrastructure, business processes, and the organization’s culture. Following this, you can move on to implementing world peace, solving global hunger, and making all politicians tell the truth. The main reason organizations do not develop and roll out an enterprise security architecture is because they do not fully understand what one is and it seems like an
ch05.indd 374
10/5/2007 11:52:26 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
375 overwhelming task. Fighting fires is more understandable and straightforward, so many companies stay with this familiar approach. If you’ll remember, in Chapter 3 we went through how to set up a security program where the following outline of tasks was provided: • Plan and Organize • Establish management commitment • Establish oversight steering committee • Assess business drivers • Carry out a threat profile on the organization • Carry out a risk assessment • Develop security architectures at an organizational, application, network, and component level • Identify solutions per architecture level • Obtain management approval to move forward • Implement • Assign roles and responsibilities • Develop and implement security policies, procedures, standards, baselines, and guidelines • Identify sensitive data at rest and in transit • Implement the following blueprints: • Asset identification and management • Risk management • Vulnerability management • Compliance • Identity management and access control • Change control • Software development life cycle • Business continuity planning • Awareness and training • Physical security • Incident response • Implement solutions (administrative, technical, physical) per blueprint
ch05.indd 375
10/5/2007 11:52:26 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
376 • Develop auditing and monitoring solutions per blueprint • Establish goals, service level agreements (SLAs), and metrics per blueprint • Operate and Maintain • Follow procedures to ensure all baselines are met in each implemented blueprint • Carry out internal and external audits • Carry out tasks outlined per blueprint • Manage service level agreements per blueprint • Monitor and Evaluate • Review logs, audit results, collected metric values, and SLAs per blueprint • Assess goal accomplishments per blueprint • Carry out quarterly meetings with steering committee • Develop improvement steps and integrate into the Plan and Organize phase NOTE
The CISSP exam may use the term “plan” instead of blueprint.
These are also the basic steps of setting up an enterprise security architecture, because a security program and the security architecture must follow the same model. The security program is often considered the administrative components, as in policies, standards, risk management, personnel security, data classification, and so on. Basically, every main concept covered in Chapter 3 is a component of a security program. An enterprise security architecture goes deeper than the security program and provides more granularity. For example, if the security policy dictates that network access control must be implemented and enforced, the architecture would cover the network schematic, network zones based on trust levels and business needs, external connections, security mechanisms, tools, processes, and roles involved at each level. The architecture works its way down from the policy level to the component level. As an analogy, let’s say Shannon tells a builder she wants a ranch style house, with four bedrooms, whose size should be 2500 square feet. This is a high-level description (policy) and the builder is not going to just wing it and see if he can build this from scratch. The builder will use a blueprint to follow (architecture), which will provide more detailed requirements that must be met to fulfill Shannon’s request. Almost all robust enterprise security architectures work with the structure provided by the Zachman Architecture Framework in one way or another. Table 5-3 shows you the makeup of this architectural framework. (In order to see the full framework, go to www.zifa.com.) The Zachman framework has been around for many years and has been used by many organizations to build or better define their business environment. This framework is not security-oriented, but it is a good template to work with because it offers direction on how to understand an actual enterprise in a modular fashion.
ch05.indd 376
10/5/2007 11:52:26 AM
ch05.indd 377
Scope context boundary • Planner
Business model concepts • Owner
System model logic • Designer
Technology model physics • Builder
Component configuration • Implementer
Functioning enterprise instances • Worker
1
2
3
4
5
6
e.g., data
e.g., function
e.g., program
e.g., system design
e.g., physical data model e.g., data definition
e.g., application architecture
e.g., business process model
List of processes the business performs
How (Function)
e.g., logical data model
e.g., semantic or entity-relationship model
List of things important to the business
What (Data)
Table 5-3 Zachman Framework for Enterprise Architecture
Layer
Order
e.g., network
e.g., network architecture
e.g., technology architecture
e.g., distributed system architecture
e.g., business logistics model
List of locations in which the business operates
Where (Network)
e.g., organization
e.g., security architecture
e.g., presentation architecture
e.g., human interface architecture
e.g., workflow model
List of organizations important to the business
Who (People)
e.g., schedule
e.g., timing definition
e.g., control structure
e.g., processing structure
e.g., master schedule
List of events significant to the business
When (Time)
e.g., strategy
e.g., rule specification
e.g., rule design
e.g., business rule model
e.g., business plan
List of business goals/strategies
Why (Motivation)
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
377
10/5/2007 11:52:27 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
378 NOTE The Zachman framework is used as a model for robust security architectures, which means it deals with many components throughout the organization. Many people are familiar with technical security architectures, which just deal with a network and the systems within that network. These are two totally different things. The robust security architecture encompasses the technical architecture and much more, as you can see in Table 5-3. The Zachman framework is a two-dimensional model that uses six basic communication interrogatives (What, How, Where, Who, When, and Why) intersecting with different levels (Planner, Owner, Designer, Builder, Implementer, and Worker) to give a holistic view of the enterprise. This framework was developed in the 1980s and is based on the principles of classical business architecture that contain rules that govern an ordered set of relationships. Based on the author’s experience, most technical people have a negative visceral reaction to models like this. They feel it’s too much work, that it’s a lot of fluff, is not directly relevant, and so on. If you handed the same group of people a network schematic with firewalls, IDSs, and VPNs, they would say, “Now were talking about security!” This is because they are technology focused and they do not understand all the other components of security, which are just as (or more) important than technology.
SABSA A group developed the Sherwood Applied Business Security Architecture (SABSA), as shown in the following table, which is based on the Zachman framework. When building a security architecture, you can visit www.sabsa-institute.org/home.aspx to learn more about this approach. While the SABSA is not exam-oriented, the Zachman framework is. So you might want to dig into this model after your CISSP exam.
ch05.indd 378
Assets (What)
Motivation (Why)
Process (How)
People (Who)
Location (Where)
Time (When)
Contextual
The business
Business risk model
Business process model
Business organization and relationships
Business geography
Business time dependencies
Conceptual
Business attributes profile
Control objectives
Security strategies and architectural layering
Security entity model and trust framework
Security domain model
Securityrelated lifetimes and deadlines
Logical
Business information model
Security policies
Security services
Entity schema and privilege profiles
Security domain definitions and associations
Security processing cycle
Physical
Business data model
Security rules, practices, and procedures
Security mechanisms
Users, applications, and user interface
Platform and network infrastructure
Control structure execution
Component
Detailed data structures
Security standards
Security products and tools
Identities, functions, actions, and ACLs
Processes, nodes, addresses, and protocols
Security step timing and sequencing
Operational
Assurance of operation continuity
Operation risk management
Security service management and support
Application and user management and support
Security of sites, networks, and platforms
Security operations schedule
10/5/2007 11:52:27 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
379 Working at the enterprise level requires different thinking than working just at the system or technical level. Not only do the solutions need to apply to the whole enterprise in a standardized manner, they need to map to business needs. For example, when thinking about access control—instead of just thinking about Kerberos, domain controllers, ACLs, and credentials—you must also consider what regulations and laws the company must comply with. If the company must comply with Sarbanes-Oxley (SOX), for example, the company needs many of these processes documented and access must be approved by managers. This may require identity management solutions instead of just depending upon Microsoft’s domain authentication technology. When an enterprise security architecture is being developed, the following items must be understood and followed: strategic alignment, process enhancement, business enablement, and security effectiveness. Strategic alignment means the business drivers and the regulatory and legal requirements are being met by the security architecture. The current security posture must be understood. This means an enterprise risk assessment was carried out so the company could understand its current threats and their ability to deal with these threats. There should be a consensus regarding the vulnerabilities and threats within the organization. It also means an acceptable risk level was set based on the company’s risk tolerance. Great, but what does this really mean? Well, strategic alignment means, “What assets do we have to protect?”, “How well are our security initiatives tied to business needs?”, “What is the definition of ‘enough security’?”, and “Is senior management on board with all of this?” The result of these efforts is to come up with an agreed-upon current risk profile and a desired profile. A three-year security plan should be developed that outlines how the organization will get to, and achieve, the desired profile, and also should detail a phased approach regarding how the full security enterprise will be built. NOTE The preceding information may seem very obvious as to what needs to first take place, but unfortunately many companies just start plugging in firewalls, configuring ACLs, and rolling out encryption solutions without setting up an overall plan. It gets everybody busy, but often they’re marching down different paths with no agreed-upon goal for everyone to be working towards. A few other items approached at the strategic stage are: • Stakeholders and their requirements are defined • Owners and custodians are identified and assigned responsibilities • Responsibility, accountability, and authority are defined and assigned • Someone buys a beer keg to get through the rest of the phases Senior management must be actively involved at this stage and provide the necessary resources and support. Without management support, the effort will limp along with no real success in the end.
ch05.indd 379
10/5/2007 11:52:27 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
380 When looking at the business enablement part of the architecture, we need to remind ourselves that companies are in business to make money. Companies and organizations do not exist for the sole purpose of being secure. Security cannot stand in the way of business processes, but should be implemented to better enable them. Many of the critical business processes deal with end-to-end transaction integrity and are commonly a large focus when security must enable business activities. Business enablement means the core business processes are integrated into the security operating model—they are standards-based and follow a risk tolerance–based criteria. What does this mean in the real world? Let’s say a company’s bean counters have figured out that if they allow the customer service and support staff to work from home, the company would save a lot of money on office rent, utilities, and overhead— plus, their insurance is cheaper. The company could move into this new model with the use of VPNs, firewalls, content filtering, and so on. If a financial institution wants to allow their customers the ability to view bank account information and carry out money transfers, it can offer this service if the correct security mechanisms were put in place. Security should help the organization thrive by providing the mechanisms to do new things safely. The process enhancement piece can be quite beneficial to an organization if it takes advantage of this capability. When an organization is serious about securing their environment, it means they will have to take a close look at many of the business processes that take place on an ongoing process. Many times these processes are viewed through the eyeglasses of security, because that’s the reason for the activity, but this is a perfect chance to enhance and improve upon the same processes to increase productivity. When you look at many business processes taking place in all types of organizations, you commonly find a duplication of efforts, manual steps that can be easily automated, or ways to streamline and reduce time and effort that are involved in certain tasks. This is commonly referred to as process reengineering. When an organization is developing its security blueprints, those blueprints must be integrated into the business processes to be effective. This can allow for process management to be refined and calibrated. This allows for security to be integrated in system life cycles and day-to-day operations. Security effectiveness deals with metrics, meeting service level agreement (SLA) requirements, return on investment (ROI), meeting set baselines, and providing management with a dashboard or balanced scorecard system. These are ways to determine how useful the current security solutions and architecture as a whole are performing. Many organizations are just getting to this point of their architecture, because there is a need to ensure that the countermeasures in place are providing the necessary level of protection and that finite funds are being used properly. Once baselines are set, then metrics can be developed to verify baseline compliancy. These metrics are then rolled up to management in a format they can understand that shows them the health of the organization’s security posture and compliance levels. This also allows management to make informed business decisions. Security affects almost everything today in business, so this information should be readily available to senior management in a form they can actually use.
ch05.indd 380
10/5/2007 11:52:28 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
381
Figure 5-21 IT Security Management and the IT Operations Maturity Model
Figure 5-21 shows how organizations are commonly evolving in their security maturity. All these items (strategic alignment, process enhancement, business enablement, and security effectiveness) can only take place if there is a strong foundation of supporting security blueprints. The blueprints outline the actual security mechanisms that will be used to provide the organization with the level of protection it needs. Blueprints that can be in place include access control, identity management, asset management, incident response, infrastructure security, application security, and so on. Without a strong and supporting security foundation, none of the other goals can actually be accomplished. It would be like trying to build a house on sand. NOTE An enterprise security foundation cannot be built without established security zones, which provides boundaries based on trust, which specifies what actually needs to be protected. This will allow protection and risk management to be carried out in a standardized manner across the enterprise.
ch05.indd 381
10/5/2007 11:52:28 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
382
A Few Threats to Review Now that we have talked about how everything is supposed to work, let’s take a quick look at some of the things that can go wrong when designing a system. Software almost always has bugs and vulnerabilities. The rich functionality demanded by users brings about deep complexity, which usually opens the doors to problems in the computer world. Also, vulnerabilities are always around because attackers continually find ways of using system operations and functionality in a negative and destructive way. Just like there will always be cops and robbers, there will always be attackers and security professionals. It is a game of trying to outwit each other and seeing who will put the necessary effort into winning the game. NOTE Carnegie Mellon University estimates there are 5 to 15 bugs in every 1000 lines of code. Windows 2000 has 40–60 million lines of code.
Maintenance Hooks In the programming world, maintenance hooks are a type of backdoor. They are instructions within software that only the developer knows about and can invoke, and which give the developer easy access to the code. They allow the developer to view and edit the code without having to go through regular access controls. During the development phase of the software, these can be very useful, but if they are not removed before the software goes into production, they can cause major security issues. The maintenance hook is usually initiated by a random sequence of keystrokes that provides access into the software without having to go through normal access control and security checks and mechanisms. An application that has a maintenance hook enables the developer to execute commands by using a specific sequence of keystrokes. Once this is done successfully, the developer can be inside the application looking directly at the code or configuration files. She might do this to watch problem areas within the code, check variable population, export more code into the program, or fix problems she sees taking place. Although this sounds nice and healthy, if an attacker finds out about this maintenance hook, he can take more sinister actions. So all maintenance hooks need to be removed from software before it goes into production. NOTE Many would think that since security is more in the minds of people today, that maintenance hooks would be a thing of the past. This is not true. Developers are still using maintenance hooks, because of their lack of understanding or care of security issues, and many maintenance hooks still reside in older software that organizations are using.
Countermeasures Because maintenance hooks are usually inserted by programmers, they are the ones who usually have to take them out before the programs go into production. Code reviews and unit and quality assurance testing should always be on the lookout for back-
ch05.indd 382
10/5/2007 11:52:29 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
383 doors, in case the programmer overlooked extracting them. Because maintenance hooks are within the code of an application or system, there is not much a user can do to prevent their presence, but when a vendor finds out a backdoor exists in its product, it usually develops and releases a patch to reduce this vulnerability. Because most vendors sell their software without including the associated source code, it may be very difficult for companies who have purchased software to identify backdoors. The following lists some preventive measures against backdoors: • Use a host intrusion detection system to watch for any attackers using backdoors into the system. • Use file system encryption to protect sensitive information. • Implement auditing to detect any type of backdoor use.
Time-of-Check/Time-of-Use Attacks Specific attacks can take advantage of the way a system processes requests and performs tasks. A time-of-check/time-of-use (TOC/TOU) attack deals with the sequence of steps a system uses to complete a task. This type of attack takes advantage of the dependency on the timing of events that take place in a multitasking operating system. As stated previously, operating systems and applications are in reality just lines and lines of instructions. An operating system must carry out instruction 1, then instruction 2, then instruction 3, and so on. This is how it is written. If an attacker can get in between instruction 2 and 3 and manipulate something, she can control the result of these activities. An example of a TOC/TOU attack is if process 1 validates the authorization of a user to open a noncritical text file and process 2 carries out the open command. If the attacker can change out this noncritical text file with a password file while process 1 is carrying out its task, she has just obtained access to this critical file. (It is a flaw within the code that allows this type of compromise to take place.) NOTE This type of attack is also referred to as an asynchronous attack. Asynchronous describes a process in which the timing of each step may vary. The attack gets in between these steps and modifies something. Race conditions are also considered TOC/TOU attacks by some in the industry. A race condition is when two different processes need to carry out their tasks on one resource. The processes need to follow the correct sequence. Process 1 needs to carry out its work before process 2 accesses the same resource and carries out its tasks. If process 2 goes before process 1, the outcome could be very different. If an attacker can manipulate the processes so process 2 does its task first, she can control the outcome of the processing procedure. Let’s say process 1’s instructions are to add 3 to a value and process 2’s instructions are to divide by 15. If process 2 carries out its tasks before process 1, the outcome would be different. So if an attacker can make process 2 do its work before process 1, she can control the result.
ch05.indd 383
10/5/2007 11:52:29 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
384 Looking at this issue from a security perspective, there are several types of race condition attacks that are quite concerning. If a system splits up the authentication and authorization steps, an attacker could be authorized before she is even authenticated. For example, in the normal sequence, process 1 verifies the authentication before allowing a user access to a resource, and process 2 authorizes the user to access the resource. If the attacker makes process 2 carry out its tasks before process 1, she can access a resource without the system making sure she has been authenticated properly. So although the terms “race condition” and “TOC/TOU attack” are sometimes used interchangeably, in reality they are two different things. A race condition is an attack in which an attacker makes processes execute out of sequence to control the result. A TOC/TOU attack is when an attacker jumps in between two tasks and modifies something to control the result.
Countermeasures It would take a dedicated attacker with great precision to perform these types of attacks, but it is possible and has been done. To protect against race condition attacks, it is best to not split up critical tasks that can have their sequence altered. This means the system should use atomic operations where only one system call is used to check authentication and then grant access in one task. This would not give the processor the opportunity to switch to another process in between two tasks. Unfortunately, using these types of atomic operations is not always possible. To avoid TOC/TOU attacks, it is best if the operating system can apply software locks to the items it will use when it is carrying out its “checking” tasks. So if a user requests access to a file, while the system is validating this user’s authorization, it should put a software lock on the file being requested. This ensures the file cannot be deleted and replaced with another file. Applying locks can be carried out easily on files, but it is more challenging to apply locks to database components and table entries to provide this type of protection.
Buffer Overflows My cup runneth over and so does my buffer. Today, many people know the term buffer overflow and the basic definition, but it is important for security professionals to understand what is going on beneath the covers. A buffer overflow takes place when too much data are accepted as input to an application or operating system. A buffer is an allocated segment of memory. A buffer can be overflowed arbitrarily with too much data, but for it to be of any use to an attacker, the code inserted into the buffer must be of a specific length, followed up by commands the attacker wants executed. So, the purpose of a buffer overflow may be either to make a mess, by shoving arbitrary data into various memory segments, or to accomplish a specific task, by pushing into the memory segment a carefully crafted set of data that will accomplish a specific task. This task could be to open a command shell with administrative privilege or execute malicious code. Let’s take a deeper look at how this is accomplished. Software may be written to accept data from a user, web site, database, or another application. The accepted data needs something to happen to it, because it has been inserted for some type of manipulation or calculation, or to be used as a parameter to be passed to a procedure. A
ch05.indd 384
10/5/2007 11:52:29 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
385 procedure is code that can carry out a specific type of function on the data and return the result to the requesting software, as shown in Figure 5-22. When a programmer writes a piece of software that will accept data, this data will be stored in a variable. When this software calls upon a procedure to carry out some type of functionality, it stacks the necessary instructions and data in a memory segment for the procedure to read from. (Memory stacks were explained earlier in the chapter, but we will go over them again in this section.) The data accepted from an outside entity is placed in a variable. This variable must have a place to live in memory, which is called a buffer. A buffer is like a memory container for data. The buffer needs to be the right size to accept the inputted data. So if the input is supposed to be one character, the buffer should be one byte in size. If a programmer does not ensure that only one byte of data is being inserted into the software, then someone can input several characters at once and thus overflow that specific buffer. The buffers hold data, which are placed on a memory stack. You can think of a buffer as a small bucket to hold water (data). We have several of these small buckets stacked on top of one another (memory stack), and if too much water is poured into the top bucket, it spills over into the buckets below it (buffer overflow) and overwrites the instructions and data on the memory stack.
Figure 5-22 A memory stack has individual buffers to hold instructions and data.
ch05.indd 385
10/5/2007 11:52:29 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
386 What Is a Stack and How Does It Work? If you are interacting with an application that calculates mortgage rates, you have to put in the parameters that need to be calculated—years of loan, percentage of interest rate, and amount of loan. These parameters are passed into empty variables and put in a linear construct (memory stack), which acts like a queue for the procedure to pull from when it carries out this calculation. The first thing your mortgage rate application lays down on the stack is its return pointer. This is a pointer to the requesting application’s memory address that tells the procedure to return control to the requesting application after the procedure has worked through all the values on the stack. The mortgage rate application then places on top of the return pointer the rest of the data you have input and sends a request to the procedure to carry out the necessary calculation, as illustrated in Figure 5-22. The procedure takes the data off the stack starting at the top, so they are first in, last off (FILO). The procedure carries out its functions on all the data and returns the result and control back to the requesting mortgage rate application once it hits the return pointer in the stack. So the stack is just a segment in memory that allows for communication between the requesting application and the procedure or subroutine. The potential for problems comes into play when the requesting application does not carry out proper bounds checking to ensure the inputted data are of an acceptable length. Look at the following C code to see how this could happen: #include<stdio.h> int main(int argc, char **argv).{ char buf1 [5] = "1111"; char buf2 [7] = "222222"; strcpy (buf2, "3333333333"); printf ("%s\n", buf2); printf ("%s\n", buf1); return 0;}
CAUTION You do not need to know C programming for the CISSP exam. We are digging deep into this topic because buffer overflows are so common and have caused grave security breaches over the years. For the CISSP exam, you just need to understand the overall concept of a buffer overflow. Here, we are setting up a buffer (buf1) to hold four characters and a NULL value, and a second buffer (buf2) to hold six characters and a NULL value. (The NULL values indicate the buffer’s end place in memory.) If we viewed these buffers, we would see the following: Buf2 \0 2 2 2 2 2 2 Buf1 \0 1 1 1 1
The application then accepts ten 3s into buf2, which can only hold six characters. So the six variables in buf2 are filled and then the four variables in buf1 are filled, overwriting the original contents of buf1. This took place because the strcpy command did not make sure the buffer was large enough to hold that many values. So now if we looked at the two buffers, we would see the following:
ch05.indd 386
10/5/2007 11:52:30 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
387 Buf2 \0 3 3 3 3 3 3 Buf1 \0 3 3 3 3
But what gets even more interesting is when the actual return pointer is written over, as shown in Figure 5-23. In a carefully crafted buffer overflow attack, the stack is filled properly so the return pointer can be overwritten and control is given to the malicious instructions that have been loaded onto the stack instead of back to the requesting application. This allows the malicious instructions to be executed in the security context of the requesting application. If this application is running in a privileged mode, the attacker has more permissions and rights to carry out more damage. The attacker must know the size of the buffer to overwrite and must know the addresses that have been assigned to the stack. Without knowing these addresses, she could not lay down a new return pointer to her malicious code. The attacker must also write this dangerous payload to be small enough so it can be passed as input from one procedure to the next. Windows’ core is written in the C language and has layers and layers of object-oriented code on top of it. When a procedure needs to call upon the operating system to carry out some type of task, it calls upon a system service via an API call. The API works like a doorway to the operating system’s functionality.
Figure 5-23 A buffer overflow attack
ch05.indd 387
10/5/2007 11:52:30 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
388 The C language is susceptible to buffer overflow attacks because it allows for direct pointer manipulations to take place. Specific commands can provide access to lowlevel memory addresses without carrying out bounds checking. The C functions that do perform the necessary boundary checking include strncpy( ), strncat( ), snprintf( ), and vsnprintf( ). An operating system must be written to work with specific CPU architectures. These architectures dictate system memory addressing, protection mechanisms, and modes of execution, and work with specific instruction sets. This means a buffer overflow attack that works on an Intel chip will not necessarily work on a Motorola or a SPARC processor. These different processors set up the memory address of the stacks differently, so the attacker may have to craft a different buffer overflow code for different platforms. This is usually not an obstacle since most times the code is already written and available via different hacking web sites.
Countermeasures Buffer overflows are in the source code of various applications and operating systems. They have been around since programmers started developing software. This means it is very difficult for a user to identify and fix them. When a buffer overflow is identified, the vendor usually sends out a patch. So keeping systems current on updates, hotfixes, and patches is usually the best countermeasure. Some products installed on systems can also watch for input values that might result in buffer overflows. But the best countermeasure is proper programming. This means to use bounds checking. If an input value is only supposed to be nine characters, then the application should only accept nine characters and no more. Some languages are more susceptible to buffer overflows than others. So programmers should understand these issues, use the right languages for the right purposes, and carry out code review to identify buffer overflow vulnerabilities.
Summary The architecture of a computer system is very important and comprises many topics. The system has to ensure that memory is properly segregated and protected, ensure that only authorized subjects access objects, ensure that untrusted processes cannot perform activities that would put other processes at risk, control the flow of information, and define a domain of resources for each subject. It also must ensure that if the computer experiences any type of disruption, it will not result in an insecure state. Many of these issues are dealt with in the system’s security policy, and the security model is built to support the requirements of this policy. Once the security policy, model, and architecture have been developed, the computer operating system, or product, must be built, tested, evaluated, and rated. An evaluation is done by comparing the system to predefined criteria. The rating assigned to the system depends upon how it fulfills the requirements of the criteria. Customers use this rating to understand what they are really buying and how much they can trust this new product. Once the customer buys the product, it must be tested within their own environment to make sure it meets their company’s needs, which takes place through certification and accreditation processes.
ch05.indd 388
10/5/2007 11:52:30 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
389
Quick Tips • Two systems can have the exact same hardware, software components, and applications, but provide different levels of protection because of the different security policies and security models the two systems were built upon. • A CPU contains a control unit, which controls the timing of the execution of instructions and data, and an ALU, which performs mathematical functions and logical operations. • Most systems use protection rings. The more privileged processes run in the lower-numbered rings and have access to all or most of the system resources. Applications run in higher-numbered rings and have access to a smaller amount of resources. • Operating system processes are executed in privileged or supervisor mode, and applications are executed in user mode, also known as “problem state.” • Secondary storage is nonvolatile and can be a hard drive, CD-ROM drive, floppy drive, tape backup, or a jump drive. • Virtual storage combines RAM and secondary storage so the system seems to have a larger bank of memory. • A deadlock situation occurs when two processes are trying to access the same resource at the same time. • Security mechanisms can focus on different issues, work at different layers, and vary in complexity. • The more complex a security mechanism is, the less amount of assurance it can usually provide. • Not all system components fall under the trusted computing base (TCB), which includes only those system components that enforce the security policy directly and protect the system. These components are within the security perimeter. • Components that make up the TCB are hardware, software, and firmware that provide some type of security protection. • A security perimeter is an imaginary boundary that has trusted components within it (those that make up the TCB) and untrusted components outside it. • The reference monitor concept is an abstract machine that ensures all subjects have the necessary access rights before accessing objects. Therefore, it mediates all accesses to objects by subjects. • The security kernel is the mechanism that actually enforces the rules of the reference monitor concept. • The security kernel must isolate processes carrying out the reference monitor concept, must be tamperproof, must be invoked for each access attempt, and must be small enough to be properly tested.
ch05.indd 389
10/5/2007 11:52:31 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
390 • A security domain is all the objects available to a subject. • Processes need to be isolated, which can be done through segmented memory addressing, encapsulation of objects, time multiplexing of shared resources, naming distinctions, and virtual mapping. • The level of security a system provides depends upon how well it enforces the security policy. • A multilevel security system processes data at different classifications (security levels), and users with different clearances (security levels) can use the system. • Processes should be assigned least privilege so they have just enough system privileges to fulfill their tasks and no more. • Some systems provide security at different layers of their architectures, which is called layering. This separates the processes and provides more protection for them individually. • Data hiding occurs when processes work at different layers and have layers of access control between them. Processes need to know how to communicate only with each other’s interfaces. • A security model maps the abstract goals of a security policy to computer system terms and concepts. It gives the security policy structure and provides a framework for the system. • A closed system is often proprietary to the manufacturer or vendor, whereas the open system allows for more interoperability. • The Bell-LaPadula model deals only with confidentiality, while the Biba and Clark-Wilson models deal only with integrity. • A state machine model deals with the different states a system can enter. If a system starts in a secure state, all state transitions take place securely, and the system shuts down and fails securely, the system will never end up in an insecure state. • A lattice model provides an upper bound and a lower bound of authorized access for subjects. • An information flow security model does not permit data to flow to an object in an insecure manner. • The Bell-LaPadula model has a simple security rule, which means a subject cannot read data from a higher level (no read up). The *-property rule means a subject cannot write to an object at a lower level (no write down). The strong star property rule dictates that a subject can read and write to objects at its own security level. • The Biba model does not let subjects write to objects at a higher integrity level (no write up), and it does not let subjects read data at a lower integrity level (no read down). This is done to protect the integrity of the data. • The Bell-LaPadula model is used mainly in military systems. The Biba and Clark-Wilson models are used in the commercial sector.
ch05.indd 390
10/5/2007 11:52:31 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
391 • The Clark-Wilson model dictates that subjects can only access objects through applications. This model also illustrates how to provide functionality for separation of duties and requires auditing tasks within software. • If a system is working in a dedicated security mode, it only deals with one level of data classification, and all users must have this level of clearance to be able to use the system. • Compartmented and multilevel security modes enable the system to process data classified at different classification levels. • Trust means that a system uses all of its protection mechanisms properly to process sensitive data for many types of users. Assurance is the level of confidence you have in this trust and that the protection mechanisms behave properly in all circumstances predictably. • The Orange Book, also called Trusted Computer System Evaluation Criteria (TCSEC), was developed to evaluate systems built to be used mainly by the military. Its use was expanded to evaluate other types of products. • In the Orange Book, D classification means a system provides minimal protection and is used for systems that were evaluated but failed to meet the criteria of higher divisions. • In the Orange Book, the C division deals with discretionary protection, and the B division deals with mandatory protection (security labels). • In the Orange Book, the A classification means the system’s design and level of protection are verifiable and provide the highest level of assurance and trust. • In the Orange Book, C2 requires object reuse protection and auditing. • In the Orange Book, B1 is the first rating that requires security labels. • In the Orange Book, B2 requires security labels for all subjects and devices, the existence of a trusted path, routine covert channel analysis, and the provision of separate administrator functionality. • The Orange Book deals mainly with stand-alone systems, so a range of books were written to cover many other topics in security. These books are called the Rainbow Series. • ITSEC evaluates the assurance and functionality of a system’s protection mechanisms separately, whereas TCSEC combines the two into one rating. • The Common Criteria was developed to provide globally recognized evaluation criteria and is in use today. It combines sections of TCSEC, ITSEC, CTCPEC, and the Federal Criteria. • The Common Criteria uses protection profiles and ratings from EAL1 to EAL7. • Certification is the technical evaluation of a system or product and its security components. Accreditation is management’s formal approval and acceptance of the security provided by a system.
ch05.indd 391
10/5/2007 11:52:31 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
392 • A covert channel is an unintended communication path that transfers data in a way that violates the security policy. There are two types: timing and storage covert channels. • A covert timing channel enables a process to relay information to another process by modulating its use of system resources. • A covert storage channel enables a process to write data to a storage medium so another process can read it. • A maintenance hook is developed to let a programmer into the application quickly for maintenance. This should be removed before the application goes into production or it can cause a serious security risk. • An execution domain is where instructions are executed by the CPU. The operating system’s instructions are executed in a privileged mode, and applications’ instructions are executed in user mode. • Process isolation ensures that multiple processes can run concurrently and the processes will not interfere with each other or affect each other’s memory segments. • The only processes that need complete system privileges are located in the system’s kernel. • TOC/TOU stands for time-of-check/time-of-use. This is a class of asynchronous attacks. • The Biba model addresses the first goal of integrity, which is to prevent unauthorized users from making modifications. • The Clark-Wilson model addresses all three integrity goals: prevent unauthorized users from making modifications, prevent authorized users from making improper modifications, and maintain internal and external consistency. • In the Clark-Wilson model, users can only access and manipulate objects through programs. It uses access triple, which is subject-program-object.
Questions Please remember that these questions are formatted and asked in a certain way for a reason. Keep in mind that the CISSP exam is asking questions at a conceptual level. Questions may not always have the perfect answer, and the candidate is advised against always looking for the perfect answer. Instead, the candidate should look for the best answer in the list. 1. What flaw creates buffer overflows? A. Application executing in privileged mode B. Inadequate memory segmentation C. Inadequate protection ring use D. Insufficient bounds checking
ch05.indd 392
10/5/2007 11:52:31 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
393 2. The operating system performs all except which of the following tasks? A. Memory allocation B. Input and output tasks C. Resource allocation D. User access to database views 3. If an operating system allows sequential use of an object without refreshing it, what security issue can arise? A. Disclosure of residual data B. Unauthorized access to privileged processes C. Data leakage through covert channels D. Compromise of the execution domain 4. What is the final step in authorizing a system for use in an environment? A. Certification B. Security evaluation and rating C. Accreditation D. Verification 5. What feature enables code to be executed without the usual security checks? A. Temporal isolation B. Maintenance hook C. Race conditions D. Process multiplexing 6. If a component fails, a system should be designed to do which of the following? A. Change to a protected execution domain B. Change to a problem state C. Change to a more secure state D. Release all data held in volatile memory 7. What security advantage does firmware have over software? A. It is difficult to modify without physical access. B. It requires a smaller memory segment. C. It does not need to enforce the security policy. D. It is easier to reprogram. 8. Which is the first level of the Orange Book that requires classification labeling of data? A. B3 B. B2
ch05.indd 393
10/5/2007 11:52:32 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
394 C. B1 D. C2 9. Which of the following best describes the security kernel? A. A software component that monitors activity and writes security events to an audit log B. A software component that determines if a user is authorized to perform a requested operation C. A software component that isolates processes and separates privileged and user modes D. A software component that works in the center protection ring and provides interfaces between trusted and untrusted objects 10. The Information Technology Security Evaluation Criteria was developed for which of the following? A. International use B. U.S. use C. European use D. Global use 11. A security kernel contains which of the following? A. Software, hardware, and firmware B. Software, hardware, and system design C. Security policy, protection mechanisms, and software D. Security policy, protection mechanisms, and system design 12. What is the purpose of base and limit registers? A. Countermeasure buffer overflows B. Time sharing of system resources, mainly the CPU C. Process isolation D. TCB enforcement 13. A guard is commonly used with a classified system. What is the main purpose of implementing and using a guard? A. To ensure that less trusted systems only receive acknowledgments and not messages B. To ensure proper information flow C. To ensure that less trusted and more trusted systems have open architectures and interoperability D. To allow multilevel and dedicated mode systems to communicate 14. The trusted computing base (TCB) controls which of the following? A. All trusted processes and software components B. All trusted security policies and implementation mechanisms
ch05.indd 394
10/5/2007 11:52:32 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
395 C. All trusted software and design mechanisms D. All trusted software and hardware components 15. What is the imaginary boundary that separates components that maintain security from components that are not security related? A. Reference monitor B. Security kernel C. Security perimeter D. Security policy 16. Which model deals only with confidentiality? A. Bell-LaPadula B. Clark-Wilson C. Biba D. Reference monitor 17. What is the best description of a security kernel from a security point of view? A. Reference monitor B. Resource manager C. Memory mapper D. Security perimeter 18. When is the security of a system most effective and economical? A. When it is designed and implemented from the beginning of the development of the system B. When it is designed and implemented as a secure and trusted front end C. When it is customized to fight specific types of attacks D. When the system is optimized before security is added 19. In secure computing systems, why is there a logical form of separation used between processes? A. Processes are contained within their own security domains so each does not make unauthorized accesses to other processes or their resources. B. Processes are contained within their own security perimeter so they can only access protection levels above them. C. Processes are contained within their own security perimeter so they can only access protection levels equal to them. D. The separation is hardware and not logical in nature. 20. What type of attack is taking place when a higher-level subject writes data to a storage area and a lower-level subject reads it? A. TOC/TOU B. Covert storage attack
ch05.indd 395
10/5/2007 11:52:32 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
396 C. Covert timing attack D. Buffer overflow 21. What type of rating does the Common Criteria give to products? A. PP B. EPL C. EAL D. A–D 22. Which best describes the *-integrity axiom? A. No write up in the Biba model B. No read down in the Biba model C. No write down in the Bell-LaPadula model D. No read up in the Bell-LaPadula model 23. Which best describes the simple security rule? A. No write up in the Biba model B. No read down in the Biba model C. No write down in the Bell-LaPadula model D. No read up in the Bell-LaPadula model 24. Which of the following was the first mathematical model of a multilevel security policy used to define the concepts of a security state and mode of access, and to outline rules of access? A. Biba B. Bell-LaPadula C. Clark-Wilson D. State machine 25. Which of the following is a true statement pertaining to memory addressing? A. The CPU uses absolute addresses. Applications use logical addresses. Relative addresses are based on a known address and an offset value. B. The CPU uses logical addresses. Applications use absolute addresses. Relative addresses are based on a known address and an offset value. C. The CPU uses absolute addresses. Applications use relative addresses. Logical addresses are based on a known address and an offset value. D. The CPU uses absolute addresses. Applications use logical addresses. Absolute addresses are based on a known address and an offset value.
ch05.indd 396
10/5/2007 11:52:32 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
397 Answers 1. D. A buffer overflow takes place when too much data are accepted as input. Programmers should implement the correct security controls to ensure this does not take place. This means they need to perform bounds checking and parameter checking to ensure that only the allowed amount of data is actually accepted and processed by the system. 2. D. The operating system has a long list of responsibilities, but implementing database views is not one of them. This is the responsibility of the database management software. 3. A. If an object has confidential data and these data are not properly erased before another subject can access them, this leftover or residual data can be accessible. This can compromise the data and system’s security by disclosing this confidential information. This is true of media (hard drives) and memory segments. 4. C. Certification is a technical review of a product, and accreditation is management’s formal approval of the findings of the certification process. This question asked you which step was the final step in authorizing a system before it is used in an environment, and that is what accreditation is all about. 5. B. Maintenance hooks get around the system’s or application’s security and access control checks by allowing whomever knows the key sequence to access the application and most likely its code. Maintenance hooks should be removed from any code before it gets into production. 6. C. The state machine model dictates that a system should start up securely, carry out secure state transitions, and even fail securely. This means that if the system encounters something it deems unsafe, it should change to a more secure state for self-preservation and protection. 7. A. Firmware is a type of software that is held in a ROM or EROM chip. It is usually used to allow the computer to communicate with some type of peripheral device. The system’s BIOS instructions are also held in firmware on the motherboard. In most situations, firmware cannot be modified unless someone has physical access to the system. This is different from other types of software that may be modified remotely or through logical means. 8. C. These assurance ratings are from the Orange Book. B levels on up require security labels be used, but the question asks which is the first level to require this. B1 comes before B2 and B3, thus it is the correct answer. 9. B. A security kernel is the software component that enforces access control for the operating system. A reference monitor is the abstract machine that holds all of the rules of access for the system. The security kernel is the active entity
ch05.indd 397
10/5/2007 11:52:33 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
398 that enforces the reference monitor’s rules. They control the access attempts of any and all subjects; a user is just one example of a subject. 10. C. In ITSEC, the I does not stand for international, it stands for information. This set of criteria was developed to be used by European countries to evaluate and rate their products. 11. A. The security kernel makes up the main component of the TCB, which is comprised of software, hardware, and firmware. The security kernel performs a lot of different activities to protect the system. Enforcing the reference monitor’s access rules is just one of those activities. 12. C. The CPU has base and limit registers that contain the starting and ending memory addresses a process is allowed to work within. This ensures the process is isolated from other processes in that it cannot interact with another process’s memory segment. 13. B. The guard accepts requests from the less trusted entity, reviews the request to make sure it is allowed, and then submits the request on behalf of the less trusted system. The goal is to ensure that information does not flow from a high security level to a low security level in an unauthorized manner. 14. D. The TCB contains and controls all protection mechanisms within the system, whether they are software, hardware, or firmware. 15. C. The security perimeter is a boundary between items that are within the TCB and items that are outside the TCB. It is just a mark of delineation between these two groups of items. 16. A. The Bell-LaPadula model was developed for the U.S. government with the main goal of keeping sensitive data unreachable to those who were not authorized to access and view the same. This model was the first mathematical model of a multilevel security policy used to define the concepts of a security state and mode of access and to outline rules of access. The Biba and Clark-Wilson models do not deal with confidentiality, but with integrity instead. 17. A. The security kernel is a portion of the operating system’s kernel and enforces the rules outlined in the reference monitor. It is the enforcer of the rules and is invoked each time a subject makes a request to access an object. 18. A. It is difficult to add useful and effective security at the end of developing a product or to add security as a front end to an existing product. Adding security at the end of a project is usually more expensive because it will break items and the team will need to go back to the drawing board and redesign and recode portions of the product. 19. A. Processes are assigned their own variables, system resources, and memory segments, which make up their domain. This is done so they do not corrupt each other’s data or processing activities.
ch05.indd 398
10/5/2007 11:52:33 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 5: Security Architecture and Design
399 20. B. A covert channel is being used when something is using a resource for communication purposes, and that is not the reason this resource was created. A process can write to some type of shared media or storage place that another process will be able to access. The first process writes to this media and the second process reads it. This action goes against the security policy of the system. 21. C. The Common Criteria uses a different assurance rating system than the previously used criteria. It has packages of specifications that must be met for a product to obtain the corresponding rating. These ratings and packages are called Evaluation Assurance Levels (EALs). Once a product achieves any type of rating, customers can view this information on an Evaluated Products List (EPL). 22. A. The *-integrity axiom (or star integrity axiom) indicates that a subject of a lower integrity level cannot write to an object of a higher integrity level. This rule is put into place to protect the integrity of the data that resides at the higher level. 23. D. The simple security rule is implemented to ensure that any subject at a lower security level cannot view data that resides at a higher level. The reason this type of rule is put into place is to protect the confidentiality of the data that resides at the higher level. This rule is used in the Bell-LaPadula model. Remember that if you see “simple” in a rule, it pertains to reading, while * or “star” pertains to writing. 24. B. This is a formal definition of the Bell-LaPadula model, which was created and implemented to protect government and military confidential information. 25. A. The physical memory addresses that the CPU uses are called absolute addresses. The indexed memory addresses that software uses are referred to as logical addresses. And relative addresses are based on a known address with an offset value applied.
ch05.indd 399
10/5/2007 11:52:33 AM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CHAPTER
Physical and Environmental Security
6
This chapter presents the following: • Administrative, technical, and physical controls • Facility location, construction, and management • Physical security risks, threats, and countermeasures • Electric power issues and countermeasures • Fire prevention, detection, and suppression • Intrusion detection systems
Security is very important to organizations and their infrastructures, and physical security is no exception. Hacking is not the only way information and their related systems can be compromised. Physical security encompasses a different set of threats, vulnerabilities, and risks than the other types of security we’ve addressed so far. Physical security mechanisms include site design and layout, environmental components, emergency response readiness, training, access control, intrusion detection, and power and fire protection. Physical security mechanisms protect people, data, equipment, systems, facilities, and a long list of company assets.
Introduction to Physical Security The physical security of computers and their resources in the 1960s and 1970s was not as challenging as it is today because computers were mostly mainframes that were locked away in server rooms, and only a handful of people knew what to do with them anyway. Today, a computer sits on almost every desk in every company, and access to devices and resources is spread throughout the environment. Companies have several wiring closets and server rooms, and remote and mobile users take computers and resources out of the facility. Properly protecting these computer systems, networks, facilities, and employees has become an overwhelming task to many companies. Theft, fraud, sabotage, vandalism, and accidents are raising costs for many companies because environments are becoming more complex and dynamic. Security and
401
ch06.indd 401
10/5/2007 1:00:13 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
402 complexity are at the opposite ends of the spectrum. As environments and technology become more complex, more vulnerabilities are introduced that allow for compromises to take place. Most companies have had memory or processors stolen from workstations, while some have had computers and laptops taken. Even worse, many companies have been victims of more dangerous crimes, such as robbery at gunpoint, a shooting rampage by a disgruntled employee, anthrax, bombs, and terrorist activities. Many companies may have implemented security guards, closed-circuit TV (CCTV) surveillance, intrusion detection systems (IDSs), and requirements for employees to maintain a higher level of awareness of security risks. These are only some of the items that fall within the physical security boundaries. If any of these does not provide the necessary protection level, it could be the weak link that causes potentially dangerous security breaches. Most people in the information security field do not think as much about physical security as they do about computer security and the associated hackers, ports, viruses, and technology-oriented security countermeasures. But information security without proper physical security could be a waste of time. Even people within the physical security market do not always have a holistic view of physical security. There are so many components and variables to understand, people have to specialize in specific fields, such as secure facility construction, risk assessment and analysis, secure data center implementation, fire protection, IDS and CCTV implementation, personnel emergency response and training, legal and regulatory aspects of physical security, and so on. Each has its own focus and skill set, but for an organization to have a solid physical security program, all of these areas must be understood and addressed. Just as most software is built with functionality as the number one goal, with security somewhere farther down the priority list, many facilities and physical environments are built with functionality and aesthetics in mind, with not as much concern for providing levels of protection. Many thefts and deaths could be prevented if all organizations were to implement physical security in an organized, mature, and holistic manner. Most people are not aware of many of the crimes that happen every day. Many people also are not aware of all the civil lawsuits that stem from organizations not practicing due diligence and due care pertaining to physical security. The following is a short list of some examples of things companies are sued for pertaining to improper physical security implementation and maintenance: • An apartment complex does not respond to a report of a broken lock on a sliding glass door and subsequently a woman who lives in that apartment is raped by an intruder. • Bushes are growing too close to an ATM, allowing criminals to hide behind them and attack individuals as they withdraw money from their accounts. • A portion of an underground garage is unlit, which allows an attacker to sit and wait for an employee who works late. • A gas station’s outside restroom has a broken lock, which allows an attacker to enter after a female customer and kill her.
ch06.indd 402
10/5/2007 1:00:23 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
403 • A convenience store hangs too many advertising signs and posters on the exterior windows, prompting thieves to choose this store because the signs hide any crimes taking place inside the store from people driving or walking by. Many examples like this take place every day. These crimes might make it to our local news stations, but there are too many incidents to be reported in national newspapers or on network news. It is important as a security professional to evaluate security from the standpoint of a potential criminal, and to detect and remedy any points of vulnerability that could be exploited by the same. Similar to how so many people are unaware of many of these “smaller” crimes that happen every day, they are also unaware of all the civil suits brought about because organizations are not practicing due diligence and due care regarding physical security. While many different examples of this occur every day, these kinds of crimes may never make the news because they are either overshadowed by larger news events or there are just too many of them to all be reported on. A security professional needs to regard security as a holistic process and as such it must be viewed from all angles and approaches. Because danger can come from anywhere and take any different number of shapes, formats, and levels of severity. Physical security has a different set of vulnerabilities, threats, and countermeasures from that of computer and information security. The set for physical security has more to do with physical destruction, intruders, environmental issues, theft, and vandalism. When security professionals look at information security, they think about how someone can enter an environment in an unauthorized manner through a port, modem, or wireless access point. When security professionals look at physical security, they are concerned with how people can physically enter an environment and cause an array of damages. The threats that an organization faces fall into many different categories: • Natural environmental threats Floods, earthquakes, storms and tornadoes, fires, extreme temperature conditions, and so forth • Supply system threats Power distribution outages, communications interruptions, and interruption of other natural energy resources such as water, steam, and gas, and so on • Manmade threats Unauthorized access (both internal and external), explosions, damage by angry employees, employee errors and accidents, vandalism, fraud, theft, and others • Politically motivated threats Strikes, riots, civil disobedience, terrorist attacks and bombings, and so forth In all situations, the primary consideration, above all else, is that nothing should impede life safety goals. When we discuss life safety, protecting human life is first priority. Good planning helps balance life safety concerns and other security measures. For example, barring a door to prevent unauthorized physical intrusion might prevent individuals from being able to escape in the event of a fire. NOTE goals.
ch06.indd 403
Life safety goals should always take precedence over all other types of
10/5/2007 1:00:24 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
404 A physical security program should comprise safety and security mechanisms. Safety deals with the protection of life and assets against fire, natural disasters, and devastating accidents. Security addresses vandalism, theft, and attacks by individuals. Many times an overlap occurs between the two, but both types of threat categories must be understood and properly planned for. This chapter addresses both safety and security mechanisms that every security professional should be aware of. Physical security must be implemented based on a layered defense model, which means that physical controls should work together in a tiered architecture. The concept is that if one layer fails, other layers will protect the valuable asset. Layers would be implemented moving from the perimeter toward the asset. For example, you would have a fence, then your facility walls, then an access control card device, then a guard, then an IDS, and then locked computer cases and safes. This series of layers will protect the company’s most sensitive assets, which would be placed in the innermost control zone of the environment. So if the bad guy were able to climb over your fence and outsmart the security guard, he would still have to circumvent several layers of controls before getting to your precious resources and systems. Security needs to protect all the assets of the organization and enhance productivity by providing a secure and predictable environment. Good security enables employees to focus on their tasks at hand, and encourages attackers to move on to a more vulnerable and easier target. This is the hope, anyway. Keeping in mind the AIC security triad that has been presented in previous chapters, we look at physical security that can affect the availability of company resources, the integrity of the assets and environment, and the confidentiality of the data and business processes.
The Planning Process Okay, so what are we doing and why? Response: We have no idea. A designer, or team of designers, needs to be identified to create or improve upon an organization’s current physical security program. The team must work with management to define the objectives of the program, design the program, and develop performance-based metrics and evaluation processes to ensure the objectives are continually being met. The objectives of the physical security program depend upon the level of protection required for the various assets and the company as a whole. And this required level of protection, in turn, depends upon the organization’s acceptable risk level. This acceptable risk level should be derived from the laws and regulations with which the organization must comply and from the threat profile of the organization overall. This requires identifying who and what could damage business assets, identifying the types of attacks and crimes that could take place, and understanding the business impact of these threats. The type of physical countermeasures required and their adequacy or inadequacy needs to be measured against the organization’s threat profile. A financial institution has a much different threat profile, and thus a much different acceptable risk level, when compared to a grocery store. The threat profile of a hospital is different from the
ch06.indd 404
10/5/2007 1:00:24 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
405 threat profile of a military base or a government agency. The team must understand the types of adversaries it must consider, the capabilities of these adversaries, and the resources and tactics these individuals would use. (Review Chapter 3 for a discussion of acceptable risk level concepts.) Physical security is a combination of people, processes, procedures, and equipment to protect resources. The design of a solid physical security program should be methodical and weigh the objectives of the program and the available resources. Although every organization is different, the approach to constructing and maintaining a physical security program is the same. The organization must first define the vulnerabilities, threats, threat agents, and targets. NOTE Remember that a vulnerability is a weakness and a threat is the potential that someone will identify this weakness and use it against you. The threat agent is the person or mechanism that actually exploits this identified vulnerability. Threats must be broken down into different categories, such as internal and external threats. Inside threats may include misbehaving devices, fire hazards, or internal employees who aim to damage the company in some way. Internal employees have intimate knowledge of the company’s facilities and assets, which is usually required to perform tasks and responsibilities—but this makes it easier for the insider to carry out damaging activity without being noticed. Unfortunately, a large threat to companies can be their own security guards, which is usually not realized until it is too late. These people have keys and access codes to all portions of a facility and usually work during employee off-hours. This gives the guards ample windows of opportunity to carry out their crimes. It is critical for a company to carry out a background investigation, or pay a company to perform this service, before hiring a security guard. If you hire a wolf to guard the chicken coop, things can get ugly. External threats come in many different forms as well. Government buildings are usually chosen targets for some types of political revenge. If a company performs abortions or conducts animal research, then activists are usually a large and constant threat. And, of course, banks and armored cars are tempting targets for organized crime members. A threat that is even trickier to protect against is collusion, in which two or more people work together to carry out fraudulent activity. Many criminal cases have uncovered insiders working with outsiders to defraud or damage a company. The types of controls for this type of activity are procedural protection mechanisms, which were described at length in Chapter 3. This may include separation of duties, pre-employment background checks, rotations of duties, and supervision. As with any type of security, most attention and awareness surrounds the exciting and headline-grabbing tidbits about large crimes being carried out and criminals being captured. In information security, most people are aware of viruses and hackers but not the components that make up a corporate security program. The same is true for physical security. Many people talk about current robberies, murders, and other criminal activity at the water cooler but do not pay attention to the necessary framework that
ch06.indd 405
10/5/2007 1:00:24 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
406 The Commission on Critical Infrastructure Protection In Chapter 2, we looked at the President’s Commission on Critical Infrastructure Protection (PCCIP), which requires organizations that are part of the national critical infrastructure to have adequate protection mechanisms in place. Although this executive order deals with technical protection of systems and data, it also deals with physical protection of the facilities themselves. It outlines that power systems, emergency services, water supply systems, gas and oil transportation, and government services must be evaluated to ensure proper physical security is implemented. It really does not make a lot of sense to ensure that hackers can’t get to your server if you don’t also ensure that someone can’t just walk in and steal it. Legislation passed over the last few years has increased the emphasis on protecting facilities that use or produce biological and chemical agents against terrorist acts. should be erected and maintained to reduce these types of activities. An organization’s physical security program should address the following goals: • Crime and disruption prevention through deterrence Fences, security guards, warning signs, and so forth • Reduction of damage through the use of delaying mechanisms Layers of defenses that slow down the adversary, such as locks, security personnel, barriers • Crime or disruption detection and so forth
Smoke detectors, motion detectors, CCTV,
• Incident assessment Response of security guards to detected incidents and determination of damage level • Response procedures Fire suppression mechanisms, emergency response processes, law enforcement notification, consultation with outside security professionals So, an organization should try to prevent crimes and disruptions from taking place, but must also plan to deal with them when they do happen. A criminal should be delayed in her activities by having to penetrate several layers of controls before gaining access to a resource. All types of crimes and disruptions should be able to be detected through components that make up the physical security program. Once an intrusion is discovered, a security guard should be called upon to assess the situation. The security guard must then know how to properly respond to a large range of potentially dangerous activities. The emergency response activities could be carried out by the organization’s internal security team or by outside experts. This all sounds straightforward enough, until the team responsible for developing the physical security program looks at all the possible threats, the finite budget that the team has to work with, and the complexity of choosing the right combination of countermeasures and ensuring that they all work together in a manner that ensures no gaps
ch06.indd 406
10/5/2007 1:00:25 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
407 of protection. All of these components must be understood in depth before the design of a physical security program can begin. As with all security programs, it is possible to determine how beneficial and effective your physical security program is only if it is monitored through a performancebased approach. This means you should devise measurements and metrics to measure the effectiveness of the chosen countermeasures. This enables management to make informed business decisions when investing in the protection of the organization’s physical security. The goal is to increase the performance of the physical security program and decrease the risk to the company in a cost-effective manner. You should establish a baseline of performance and thereafter continually evaluate performance to make sure that the company’s protection objectives are being met. The following provides some examples of possible performance metrics: • Number of successful crimes • Number of successful disruptions • Number of unsuccessful crimes or disruptions • Time between detection, assessment, and recovery steps • Business impact of disruptions • Number of false-positive detection alerts • Time it took for a criminal to defeat a control • Time it took to restore the operational environment Capturing and monitoring these types of metrics enables the organization to identify deficiencies, evaluate improvement measures, and perform cost/benefit analyses. The physical security team needs to carry out a risk analysis, which will identify the organization’s vulnerabilities, threats, and business impacts. The team should present these findings to management and work with them to define an acceptable risk level for the physical security program. From there, the team must develop baselines (minimum levels of security) and metrics in order to evaluate and determine if the baselines are being met by the implemented countermeasures. Once the team identifies and implements the countermeasures, the performance of these countermeasures should be continually evaluated and expressed in the previously created metrics. These performance values are compared to the set baselines. If the baselines are continually maintained, then the security program is successful, because the company’s acceptable risk level is not being exceeded. This is illustrated in Figure 6-1. So, before an effective physical security program can be rolled out, the following steps must be taken: • Identify a team of internal employees and/or external consultants who will build the physical security program through the following steps. • Carry out a risk analysis to identify the vulnerabilities and threats and calculate the business impact of each threat. • Work with management to define an acceptable risk level for the physical security program.
ch06.indd 407
10/5/2007 1:00:25 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
408
Figure 6-1 Relationships of risk, baselines, and countermeasures
• Derive the required performance baselines from the acceptable risk level. • Create countermeasure performance metrics. • Develop criteria from the results of the analysis, outlining the level of protection and performance required for the following categories of the security program: • Deterrence • Delaying • Detection • Assessment • Response • Identify and implement countermeasures for each program category. • Continuously evaluate countermeasures against the set baselines to ensure the acceptable risk level is not exceeded. Once these steps have taken place (or continue to take place, as in the case of the last step), then the team is ready to move forward in its actual design phase. The design will incorporate the controls required for each category of the program; deterrence, delaying, detection, assessment, and response. We will dig deeper into these categories and their corresponding controls later in the chapter in the “Designing a Physical Security Program” section. One of the most commonly used approaches in physical security program development is described in the following section.
ch06.indd 408
10/5/2007 1:00:25 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
409 Crime Prevention Through Environmental Design This place is so nice and pretty and welcoming. No one would want to carry out crimes here. Crime Prevention Through Environmental Design (CPTED) is a discipline that outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior. It provides guidance in loss and crime prevention through proper facility construction and environmental components and procedures. CPTED concepts were developed in the 1960s. They have been built upon and have matured as our environments and crime types have evolved. CPTED has been used not just to develop corporate physical security programs, but also for large-scale activities such as development of neighborhoods, towns, and cities. It addresses landscaping, entrances, facility and neighborhood layouts, lighting, road placement, and traffic circulation patterns. It looks at microenvironments, such as offices and restrooms, and macroenvironments, like campuses and cities. The crux of CPTED is that the physical environment can be manipulated to create behavioral effects that will reduce crime and the fear of crime. It looks at the components that make up the relationship between humans and their environment. This encompasses the physical, social, and psychological needs of the users of different types of environments and predictable behaviors of these users and offenders. CPTED provides guidelines on items some of us might not consider. For example, hedges and planters around a facility should not be higher than 2.5 feet tall, so they cannot be used to gain access to a window. A data center should be located at the center of a facility, so the facility’s walls will absorb any damages from external forces, instead of the data center. Street furnishings (benches and tables) encourage people to sit and watch what is going on around them, which discourages criminal activity. A corporation’s landscape should not include wooded areas or other places where intruders can hide. Ensure that CCTV cameras are mounted in full view, so criminals know their activities will be captured and other people know the environment is well monitored and thus safer.
Similarities in Approaches The risk analysis steps are very similar to the steps outlined in Chapter 3 for the development of an organizational security program and the steps outlined in Chapter 9 for a business impact analysis, because each of these processes (development of an information security program, a physical security program, or a business continuity plan) accomplishes goals that are similar to the goals of the other two processes, but with different focuses. Each process requires a team to carry out a risk analysis, to determine the company’s threats and risks. An information security program looks at the internal and external threats to resources and data through business processes and technological means. Business continuity looks at how natural disasters and disruptions could damage the organization, while physical security looks at internal and external physical threats to the company resources. Each requires a solid risk analysis process. Review Chapter 3 to understand the core components of every risk analysis.
ch06.indd 409
10/5/2007 1:00:26 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
410 CPTED and target hardening are two different approaches. Target hardening focuses on denying access through physical and artificial barriers (alarms, locks, fences, and so on). Traditional target hardening can lead to restrictions on the use, enjoyment, and aesthetics of an environment. Sure, we can implement hierarchies of fences, locks, and intimidating signs and barriers—but how pretty would that be? If your environment is a prison, this look might be just what you need. But if your environment is an office building, you’re not looking for Fort Knox décor. Nevertheless, you still must provide the necessary levels of protection, but your protection mechanisms should be more subtle and unobtrusive. Let’s say your organization’s team needs to protect a side door at your facility. The traditional target-hardening approach would be to put locks, alarms, and cameras on the door, install an access control mechanism, such as a proximity reader, and instruct security guards to monitor this door. The CPTED approach would be to ensure there is no sidewalk leading to this door from the front of the building if you don’t want customers using it. The CPTED approach would also ensure no tall trees or bushes block the ability to view someone using this door. Barriers such as trees and bushes may make intruders feel more comfortable in attempting to break in through a secluded door. The best approach is usually to build an environment from a CPTED approach and then apply the target-hardening components on top of the design where needed. If a parking garage was developed using the CPTED approach, the stair towers and elevators within the garage may have glass windows instead of metal walls, so people feel safer and potential criminals will not carry out crimes in this more visible environment. Pedestrian walkways would be created such that people could look out across the rows of cars and see any suspicious activities. The different rows for cars to park in would be separated by low walls and structural pillars, instead of solid walls, to allow pedestrians to view activities within the garage. CPTED provides three main strategies to bring together the physical environment and social behavior to increase overall protection: natural access control, natural surveillance, and territorial reinforcement.
Natural Access Control Natural access control is the guidance of people entering and leaving a space by the placement of doors, fences, lighting, and even landscaping. For example, an office building may have external bollards with lights in them, as shown in Figure 6-2. These bollards actually carry out different safety and security services. The bollards themselves protect the facility from physical destruction by preventing people from driving their cars into the building. The light emitted helps ensure that criminals do not have a dark place to hide. And the lights and bollard placement guides people along the sidewalk to the entrance, instead of using signs or railings. As shown in Figure 6-2, the landscape, sidewalks, lighted bollards, and clear sight lines are used as natural access controls.
ch06.indd 410
10/5/2007 1:00:26 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
411
Figure 6-2 Sidewalks, lights, and landscaping can be used for protection.
They work together to give individuals a feeling of being in a safe environment and help dissuade criminals by working as deterrents. NOTE Bollards are short posts commonly used to prevent vehicular access and to protect a building or people walking on a sidewalk from vehicles. They can also be used to direct foot traffic. Clear lines of sight and transparency can be used to discourage potential offenders, because of the visible absence of places to hide or carry out criminal activities. The CPTED model shows how security zones can be created. An environment’s space should be divided into zones with different security levels, depending upon who needs to be in that zone and the associated risk. The zones can be labeled as controlled, restricted, public, or sensitive. This is conceptually similar to information classification, as described in Chapter 3. In a data classification program, different classifications are created, along with data handling procedures and the level of protection that each classification requires. The same is true of physical zones. Each zone should have a specific
ch06.indd 411
10/5/2007 1:00:26 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
412 protection level required of it, which will help dictate the types of controls that should be put into place.
Access control should be in place to control and restrict individuals from going from one security zone to the next. Access control should also be in place for all facility entrances and exits. The security program development team needs to consider other ways in which intruders can gain access to buildings, such as by climbing adjacent trees to access skylights, upper-story windows, and balconies. The following controls are commonly used for access controls within different organizations: • Limit the number of entry points. • Force all guests to go to a front desk and sign in before entering the environment. • Reduce the number of entry points even further after hours or during the weekend when not as many employees are around. • Have a security guard validate a picture ID before allowing entrance. • Require guests to sign in and be escorted. • Encourage employees to question strangers. Access barriers can be naturally created (cliffs, rivers, hills), existing manmade elements (railroad tracks, highways), or artificial forms designed specifically to impede movement (fences, closing streets).
ch06.indd 412
10/5/2007 1:00:27 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
413 Natural Surveillance Surveillance can also take place through organized means (security guards), mechanical means (CCTV), and natural strategies (straight lines of sight, low landscaping, raised entrances). The goal of natural surveillance is to make criminals feel uncomfortable by providing many ways observers could potentially see them, and make all other people feel safe and comfortable, by providing an open and well-designed environment. Natural surveillance is the use and placement of physical environmental features, personnel walkways, and activity areas in ways that maximize visibility. Figure 6-3 illustrates a stairway in a parking garage designed to be open and allow easy observation.
Territorial Reinforcement The third CPTED strategy is territorial reinforcement, which creates physical designs that emphasize or extend the company’s physical sphere of influence so legitimate users feel a sense of ownership of that space. Territorial reinforcement can be implemented through the use of walls, fences, landscaping, light fixtures, flags, clearly marked addresses, and decorative sidewalks. The goal of territorial reinforcement is to create a sense of a dedicated community. Companies implement these elements so employees
Figure 6-3 Open areas reduce the likelihood of criminal activity.
ch06.indd 413
10/5/2007 1:00:28 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
414 feel proud of their environment and have a sense of belonging, which they will defend if required to do so. These elements are also implemented to give potential offenders the impression that they do not belong there, that their activities are at risk of being observed, and that their illegal activities will not be tolerated or ignored. Most corporate environments use a mix of the CPTED and target-hardening approaches. CPTED deals mainly with the construction of the facility, its internal and external designs, and exterior components such as landscaping and lighting. If the environment is built based on CPTED, then the target hardening is like icing on the cake. The target-hardening approach applies more granular protection mechanisms, such as locks and motion detectors. The rest of the chapter looks at physical controls that can be used in both models.
Designing a Physical Security Program Our security guards should wear pink uniforms and throw water balloons at intruders. Response: Very scary environment indeed! If a team is organized to assess the protection level of an existing facility, it needs to investigate the following: • HVAC systems • Construction materials of walls and ceilings • Power distribution systems • Communication paths and types (copper, telephone, fiber) • Surrounding hazardous materials • Exterior components: • Topography • Proximity to airports, highways, railroads • Potential electromagnetic interference from surrounding devices • Climate • Soil • Existing fences, detection sensors, cameras, barriers • Working hours of employees • Operational activities that depend upon physical resources • Vehicle activity • Neighbors To properly obtain this information, the team should do surveys and interview various employees. All of this collected data will help the team to evaluate the current controls, identify weaknesses, and ensure operational productivity is not negatively affected by implementing new controls. Although there are usually written policies and procedures on what should be taking place pertaining to physical security, policies and reality do not always match up. It is
ch06.indd 414
10/5/2007 1:00:28 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
415 Activity Support CPTED also encourages activity support, which is planned activities for the areas to be protected. These activities are designed to get people to work together to increase the overall awareness of acceptable and unacceptable activities in the area. The activities could be neighborhood watch groups, company barbeques, block parties, or civic meetings. This strategy is sometimes the reason for particular placement of basketball courts, soccer fields, or baseball fields in open parks. The increased activity will hopefully keep the bad guys from milling around doing things the community does not welcome.
important for the team to observe how the facility is used, note daily activities that could introduce vulnerabilities, and determine how the facility is protected. This information should be documented and compared to the information within the written policy and procedures. In most cases, existing gaps must be addressed and fixed. Just writing out a policy helps no one if it is not actually followed. Every organization must comply with various regulations, whether they be safety and health regulations, fire codes, state and local building codes, Departments of Defense, Energy, or Labor requirements, or some other agency’s regulations. The organization may also have to comply with requirements of the Occupational Safety and Health Administration (OSHA) and the Environmental Protection Agency (EPA), if it is operating in the United States, or with the requirements of equivalent organizations within another country. The physical security program development team must understand all the regulations the organization must comply with and how to reach compliance through physical security and safety procedures. Legal issues must be understood and properly addressed, also. These issues may include access availability for the disabled, liability issues, the failure to protect assets and people, excessive force used by security guards, and so on. This long laundry list of items can get a company into legal trouble if it is not doing what it is supposed to. Occasionally, the legal trouble may take the form of a criminal case—for example, if doors default to being locked when power is lost and, as a result, several employees are trapped and killed during a fire, criminal negligence may be alleged. Legal trouble can also come in the form of civil cases—for instance, if a company does not remove the ice on its sidewalks and a pedestrian falls and breaks his ankle, the pedestrian may sue the company. The company may be found negligent and held liable for damages. Every organization should have a facility safety officer, whose main job is to understand all the components that make up the facility and what the company needs to do to protect its assets and stay within compliance. This person should oversee facility management duties day in and day out, but should also be heavily involved with the team that has been organized to evaluate the organization’s physical security program. A physical security program is a collection of controls that are implemented and maintained to provide the protection levels necessary to be in compliance with the physical security policy. The policy should embody all the regulations and laws that must be adhered to and should set the risk level the company is willing to accept.
ch06.indd 415
10/5/2007 1:00:28 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
416 By this point, the team has carried out a risk analysis, which consisted of identifying the company’s vulnerabilities, threats, and business impact pertaining to the identified threats. The program design phase should begin with a structured outline, which will evolve into a framework. This framework will then be fleshed out with the necessary controls and countermeasures. The outline should contain the program categories and the necessary countermeasures. The following is a simplistic example: I. Deterrence of criminal activity A. Fences B. Warning signs C. Security guards D. Dogs II. Delay of intruders to help ensure they can be caught A. Locks B. Defense-in-depth measures C. Access controls III. Detection of intruders A. External intruder sensors B. Internal intruder sensors IV. Assessment of situations A. Security guard procedures B. Communication structure (calling tree) V. Response to intrusions and disruptions A. Response force B. Emergency response procedures C. Police, fire, medical personnel The team can then start addressing each phase of the security program, usually starting with the facility.
Facility I can’t see the building. Response: That’s the whole idea. When a company decides to erect a building, it should consider several factors before pouring the first batch of concrete. Of course, land prices, customer population, and marketing strategies are reviewed, but as security professionals, we are more interested in the confidence and protection that a specific location can provide. Some organizations that deal with top-secret or confidential information make their facilities unnoticeable so they do not attract the attention of would-be attackers. The building may be hard to see from the surrounding roads, the company signs and logos may be small and not easily noticed, and the markings on the building may not give away any
ch06.indd 416
10/5/2007 1:00:29 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
417 information that pertains to what is going on inside that building. It is a type of urban camouflage that makes it harder for the enemy to seek out that company as a target. A company should evaluate how close the facility would be to a police station, fire station, and medical facilities. Many times, the proximity of these entities raises the real estate value of properties, but for good reason. If a chemical company that manufactures highly explosive materials needs to build a new facility, it may make good business sense to put it near a fire station. (Although the fire station might not be so happy.) If another company that builds and sells expensive electronic devices is expanding and needs to move operations into another facility, police reaction time may be looked at when choosing one facility location over another. Each of these issues—police station, fire station, and medical facility proximity—can also reduce insurance rates and must be looked at carefully. Remember that the ultimate goal of physical security is to ensure the safety of personnel. Always keep that in mind when implementing any sort of physical security control. Protect your fellow humans, be your brother’s keeper, and then run. Some buildings are placed in areas surrounded by hills or mountains to help prevent eavesdropping of electrical signals emitted by the facility’s equipment. In some cases, the organization itself will build hills or use other landscaping techniques to guard against eavesdropping. Other facilities are built underground or right into the side of a mountain for concealment and disguise in the natural environment, and for protection from radar tools, spying activities, and aerial bomb attacks.
Issues with Selecting a Facility Site When selecting a location for a facility, some of the following items are critical to the decision-making process: • Visibility • Surrounding terrain • Building markings and signs • Types of neighbors • Population of the area • Surrounding area and external entities • Crime rate, riots, terrorism attacks • Proximity to police, medical, and fire stations • Possible hazards from surrounding area • Accessibility • Road access • Traffic • Proximity to airports, train stations, and highways • Natural disasters • Likelihood of floods, tornadoes, earthquakes, or hurricanes • Hazardous terrain (mudslides, falling rock from mountains, or excessive snow or rain)
ch06.indd 417
10/5/2007 1:00:29 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
418 Construction We need a little more than glue, tape, and a stapler. Physical construction materials and structure composition need to be evaluated for their appropriateness to the site environment, their protective characteristics, their utility, and their costs and benefits. Different building materials provide different levels of fire protection and have different rates of combustibility, which correlate with their fire ratings. When making structural decisions, the decision of what type of construction material to use (wood, concrete, or steel) needs to be considered in light of what the building is going to be used for. If an area is going to be used to store documents and old equipment, it has far different needs and legal requirements than if it is going to be used for employees to work in every day. The load (how much weight that can be held) of a building’s walls, floors, and ceilings needs to be estimated and projected to ensure the building will not collapse in different situations. In most cases, this may be dictated by local building codes. The walls, ceilings, and floors must contain the necessary materials to meet the required fire rating and to protect against water damage. The windows (interior and exterior) may need to provide ultraviolet (UV) protection, may need to be shatterproof, or may need to be translucent or opaque, depending on the placement of the window and the contents of the building. The doors (exterior and interior) may need to have directional openings, have the same fire rating as the surrounding walls, prohibit forcible entries, display emergency egress markings, and, depending on placement, have monitoring and attached alarms. In most buildings, raised floors are used to hide and protect wires and pipes, but in turn the floors’ outlets need to be electrically grounded because they are raised. Building codes may regulate all of these issues, but there are still many options within each category that the physical security program development team should review for extra security protection. The right options should accomplish the company’s security and functionality needs and still be cost-effective. When designing and building a facility, the following major items need to be addressed from a physical security point of view: • Walls • Combustibility of material (wood, steel, concrete) • Fire rating • Reinforcements for secured areas • Doors • Combustibility of material (wood, pressed board, aluminum) • Fire rating • Resistance to forcible entry • Emergency marking • Placement • Locked or controlled entrances • Alarms
ch06.indd 418
10/5/2007 1:00:29 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
419 Ground If you are holding a power cord that has two skinny metal pieces and one fatter, rounder metal piece, which all go into the outlet—what is that fatter, rounder piece for? It is a ground connector, which is supposed to act as the conduit for any excess current to ensure that people and devices are not negatively affected by a spike in electrical current. So, in the wiring of a building, where do you think this ground should be connected? Yep, to the ground. Old mother earth. But many buildings are not wired properly and the ground connector is connected to nothing. This can be very dangerous, since the extra current has nowhere to escape but into our equipment or ourselves. • Secure hinges • Directional opening • Electric door locks that revert to an unlocked state for safe evacuation in power outages • Type of glass—shatterproof or bulletproof glass requirements • Ceilings • Combustibility of material (wood, steel, concrete) • Fire rating • Weight-bearing rating • Drop-ceiling considerations • Windows • Translucent or opaque requirements • Shatterproof • Alarms • Placement • Accessibility to intruders • Flooring • Weight-bearing rating • Combustibility of material (wood, steel, concrete) • Fire rating • Raised flooring (electrical grounding) • Nonconducting surface and material • Heating, ventilation, and air conditioning • Positive air pressure • Protected intake vents • Dedicated power lines
ch06.indd 419
10/5/2007 1:00:30 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
420 • Emergency shutoff valves and switches • Placement • Electric power supplies • Backup and alternate power supplies • Clean and steady power source • Dedicated feeders to required areas • Placement and access to distribution panels and circuit breakers • Water and gas lines • Shutoff valves—labeled and brightly painted for visibility • Positive flow (material flows out of building, not in) • Placement—properly located and labeled • Fire detection and suppression • Placement of sensors and detectors • Placement of suppression systems • Type of detectors and suppression agents The risk analysis results will help the team determine the type of construction material that should be used when constructing a new facility. Several grades of building construction are available. For example, light frame construction material provides the least amount of protection against fire and forcible entry attempts. It is composed of untreated lumber that would be combustible during a fire. Light frame construction material is usually used to build homes, primarily because it is cheap but also because homes typically are not under the same types of fire and intrusion threats that office buildings are. Heavy timber construction material is commonly used for office buildings. Combustible lumber is still used in this type of construction, but there are requirements on the thickness and composition of the materials to provide more protection from fire. The construction materials must be at least four inches in thickness. More dense woods are used and are fastened with metal bolts and plates. Whereas light frame construction material has a fire survival rate of 30 minutes, the heavy timber construction material has a fire rate of one hour. A building could be made up of incombustible material, such as steel, which provides a higher level of fire protection than the previously mentioned materials but loses its strength under extreme temperatures, something that may cause the building to collapse. So, although the steel will not burn, it may melt and weaken. If a building consists of fire-resistant material, the construction material is fire-retardant and has steel rods encased inside of concrete walls and support beams. This provides the most protection against fire and forced entry attempts. The team should choose its construction material based on the identified threats of the organization and the fire codes to be complied with. If a company is just going to have some office workers in a building and has no real adversaries interested in destroying the facility, then the light frame or heavy timber construction material would be used. Facilities for government organizations, which are under threat by domestic and
ch06.indd 420
10/5/2007 1:00:30 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
421 foreign terrorists, would be built with fire-resistant materials. A financial institution would also use fire-resistant and reinforcement material within its building. This is especially true for its exterior walls, through which thieves may attempt to drive vehicles to gain access to the vaults. Calculations of approximate penetration times for different types of explosives and attacks are based on the thickness of the concrete walls and the gauge of rebar used. (Rebar refers to the steel rods encased within the concrete.) So even if the concrete can be damaged, it will take longer to actually cut or break through the rebar. Using thicker rebar and properly placing it within the concrete provides even more protection. Reinforced walls, rebar, and the use of double walls can be used as delaying mechanisms. The idea is that it will take the bad guy longer to get through two reinforced walls, which gives the response force sufficient time to arrive at the scene and stop the attacker, we hope.
Entry Points Understanding the company needs and types of entry points for a specific building is critical. The various types of entry points may include doors, windows, roof access, fire escapes, chimneys, and service delivery access points. Second and third entry points must also be considered, such as internal doors that lead into other portions of the building and to exterior doors, elevators, and stairwells. Windows at the ground level should be fortified, because they could be easily broken. Fire escapes, stairwells to the roof, and chimneys are many times overlooked as potential entry points. NOTE Ventilation ducts and utility tunnels can also be used by intruders and thus must be properly protected with sensors and access control mechanisms.
The weakest portion of the structure, usually its doors and windows, will likely be attacked first. With regard to doors, the weaknesses usually lie within the frames, hinges, and door material. The bolts, frames, hinges, and material that make up the door should all provide the same level of strength and protection. For example, if a company implements a heavy, nonhollow steel door but uses weak hinges that could be easily extracted, the company is just wasting money. The attacker can just remove the hinges and remove this strong and heavy door. The door and surrounding walls and ceilings should also provide the same level of strength. If another company has an extremely fortified and secure door but the surrounding wall materials are made out of regular light frame wood, then it is also wasting money on doors. There is no reason to spend a lot of money on one countermeasure that can be easily circumvented by breaking a weaker countermeasure in the same proximity. Doors
Different door types for various functionalities include the following:
• Vault doors • Personnel doors • Industrial doors • Vehicle access doors • Bullet-resistant doors
ch06.indd 421
10/5/2007 1:00:30 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
422 Doors can be hollow-core or solid-core. The team needs to understand the various entry types and the potential forced-entry threats, which will help them determine what type of door should be implemented. Hollow-core doors can be easily penetrated by kicking or cutting them; thus, they are usually used internally. The team also has a choice of solid-core doors, which are made up of various materials to provide different fire ratings and protection from forced entry. As stated previously, the fire rating and protection level of the door needs to match the fire rating and protection level of the surrounding walls. Bulletproof doors are also an option if there is a threat that damage could be done to resources by shooting through the door. These types of doors are constructed in a manner that involves sandwiching bullet-resistant and bulletproof material between wood or steel veneers to still give the door some aesthetic qualities while providing the necessary levels of protection. Hinges and strike plates should be secure, especially on exterior doors or doors used to protect sensitive areas. The hinges should have pins that cannot be removed, and the door frames must provide the same level of protection as the door itself. Fire codes dictate the number and placement of doors with panic bars on them. These are the crossbars that release an internal lock to allow a locked door to open. Panic bars can be on regular entry doors and also emergency exit doors. Those are the ones that usually have the sign that indicates the door is not an exit point and that an alarm will go off if opened. It might seem like fun and a bit tempting to see if the alarm will really go off or not—but don’t try it. You’re just asking for lots of yelling and dirty looks from the facility management group. Mantraps and turnstiles can be used so unauthorized individuals entering a facility cannot get in or out if it is activated. A mantrap is a small room with two doors. The first door is locked; a person is identified and authenticated by a security guard, biometric system, smart card reader, or swipe card reader. Once the person is authenticated and access is authorized, the first door opens and allows the person into the mantrap. The first door locks and the person is trapped. The person must be authenticated again before the second door unlocks and allows him into the facility. Some mantraps use biometric systems that weigh the person who enters, to ensure only one person at a time is entering the mantrap area. This is a control to counter piggybacking.
ch06.indd 422
10/5/2007 1:00:30 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
423 Doorways with automatic locks can be configured to be fail-secure or fail-safe. A fail-safe setting means that if a power disruption occurs that affects the automated locking system, the doors default to being unlocked. A fail-secure configuration means that the doors default to being locked if there are any problems with the power. Windows Windows should be properly placed (this is where security and aesthetics can come to blows) and should have frames of the proper strengths, the necessary glazing material, and possibly have a protective covering. The glazing material, which is applied to the windows as they are being made, may be standard, tempered, acrylic, wire, or laminated on glass. Standard glass windows are commonly used in residential homes and are easily broken. Tempered glass is made by heating the glass and then suddenly cooling it. This increases its mechanical strength, which means it can handle more stress and is harder to break. It is usually five to seven times stronger than standard glass. Acrylic glass can be made out of polycarbonate acrylic, which is stronger than standard glass but produces toxic fumes if burned. Polycarbonate acrylics are stronger than regular acrylics, but both are made out of a type of transparent plastic. Because of their combustibility, their use may be prohibited by fire codes. The strongest window material is glass-clad polycarbonate. It is resistant to a wide range of threats (fire, chemical, breakage), but of course is much more expensive. These types of windows would be used in areas that are under the greatest threat. Some windows are made out of glass that has embedded wires—in other words, it actually has two sheets of glass, with the wiring in between. The wires help reduce the likelihood of the window being broken or shattering. Laminated glass has two sheets of glass with a plastic film in between. This added plastic makes it much more difficult to break the window. As with other types of glass, laminated glass can come in different depths. The greater the depth (more glass and plastic), the more difficult it is to break. A lot of window types have a film on them that provides efficiency in heating and cooling. They filter out UV rays and are usually tinted, which can make it harder for the bad guy to peep in and monitor internal activities. Some window types have a different kind of film applied that makes it more difficult to break them, whether by explosive, storm, or intruder.
Internal Compartments Many components that make up a facility must be looked at from a security point of view. Internal partitions are used to create barriers between one area and another. These partitions can be used to segment separate work areas, but should never be used in protected areas that house sensitive systems and devices. Many buildings have dropped ceilings, meaning the interior partitions do not extend to the true ceiling—only to the dropped ceiling. An intruder can lift a ceiling panel and climb over the partition. This example of intrusion is shown in Figure 6-4. In many situations, this would not require forced entry, specialized tools, or much effort. (In some office buildings, this may even be possible from a common public-access hallway.) These types of internal partitions should not be relied upon to provide protection for sensitive areas.
ch06.indd 423
10/5/2007 1:00:31 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
424 Window Types A security professional may be involved with the planning phase of building a facility, and each of these items comes into play when constructing a secure building and environment. The following sums up the types of windows that can be used: • Standard No extra protection. The cheapest and lowest level of protection. • Tempered Glass is heated and then cooled suddenly to increase its integrity and strength. • Acrylic A type of plastic instead of glass. Polycarbonate acrylics are stronger than regular acrylics. • Wired A mesh of wire is embedded between two sheets of glass. This wire helps prevent the glass from shattering. • Laminated The plastic layer between two outer glass layers. The plastic layer helps increase its strength against breakage. • Solar window film Provides extra security by being tinted and offers extra strength due to the film’s material. • Security film Transparent film is applied to the glass to increase its strength.
Computer and Equipment Rooms It used to be necessary to have personnel within the computer rooms for proper maintenance and operations. Today, most servers, routers, switches, mainframes, and other equipment housed in computer rooms can be controlled remotely. This enables computers to live in rooms that have fewer people milling around and spilling coffee. Because the computer rooms no longer have personnel sitting and working in them for long periods, the rooms can be constructed in a manner that is efficient for equipment instead of people.
Figure 6-4 An intruder can lift ceiling panels and enter a secured area with little effort.
ch06.indd 424
10/5/2007 1:00:31 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
425 Smaller systems can be stacked vertically to save space. They should be mounted on racks or placed inside equipment cabinets. The wiring should be close to the equipment to save on cable costs and to reduce tripping hazards. Data centers, server rooms, and wiring closets should be located in the core areas of a facility, near wiring distribution centers. Strict access control mechanisms and procedures should be implemented for these areas. The access control mechanisms may be smart card readers, biometric readers, or combination locks, as described in Chapter 4. These restricted areas should have only one access door, but fire code requirements typically dictate there must be at least two doors to most data centers and server rooms. Only one door should be used for daily entry and exit and the other door should be used only in emergency situations. This second door should not be an access door, which means people should not be able to come in through this door. It should be locked, but should have a panic bar that will release the lock if pressed. These restricted areas ideally should not be directly accessible from public areas like stairways, corridors, loading docks, elevators, and restrooms. This helps ensure that the people who are by the doors to secured areas have a specific purpose for being there, versus being on their way to the restroom or standing around in a common area gossiping about the CEO. Because data centers usually hold expensive equipment and the company’s critical data, their protection should be thoroughly thought out before implementation. Data centers should not be located on the top floors because it would be more difficult for an emergency crew to access it in a timely fashion in case of a fire. By the same token, data centers should not be located in basements where flooding can affect the systems. And if a facility is in a hilly area, the data center should be located well above ground level. Data centers should be located at the core of a building, to provide protection from natural disasters or bombs and to provide easier access to emergency crews if necessary. Which access controls and security measures should be implemented for the data center depends upon the sensitivity of the data being processed and the protection level required. Alarms on the doors to the data processing center should be activated during off-hours and there should be policies dictating how to carry out access control during normal business hours, after hours, and during emergencies. If a combination lock is used to enter the data processing center, the combination should be changed at least every six months and also after an employee who knows the code leaves the company. The various controls discussed next are shown in Figure 6-5. The team responsible for designing a new data center (or evaluating a current data center) should understand all the controls shown in Figure 6-5 and be able to choose what is needed. The data processing center should be constructed as one room rather than different individual rooms. The room should be away from any of the building’s water pipes in case a break in a line causes a flood. The vents and ducts from the HVAC system should be protected with some type of barrier bars and should be too small for anyone to crawl through and gain access to the center. The data center must have positive air pressure, so no contaminants can be sucked into the room and into the computers’ fans. In many data centers, an emergency Off switch is situated next to the door so someone can turn off the power if necessary. If a fire occurs, this emergency Off switch should be flipped as employees are leaving the room and before the fire suppression
ch06.indd 425
10/5/2007 1:00:31 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
426
Figure 6-5 A data center should have many physical security controls.
agent is released. This is critical if the suppression agent is water, because water and electricity are not a good match—especially during a fire. A company can install a fire suppression system that is tied into this switch, so when a fire is detected, the electricity is automatically shut off right before the suppression material is released. (The suppression material could be a type of gas, such as halon, or FM-200, or water. Gases are usually a better choice for environments filled with computers. We will cover different suppression agents in the “Fire Prevention, Detection, and Suppression” section later in the chapter.) Portable fire extinguishers should be located close to the equipment and should be easy to see and access. Smoke detectors or fire sensors should be implemented, and water sensors should be placed under the raised floors. Since most of the wiring and cables run under the raised floors, it is important that water does not get to these places and, if it does, that an alarm sound if water is detected. NOTE If there is any type of water damage in a data center or facility, mold and mildew could easily become a problem. Instead of allowing things to “dry out on their own,” many times it is better to use industry-strength dehumidifiers, water movers, and sanitizers to ensure secondary damage does not occur.
ch06.indd 426
10/5/2007 1:00:32 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
427 Although water is very useful, sometimes it is not our best friend. Water can cause extensive damage to equipment, flooring, walls, computers, and facility foundations. It is important that an organization be able to detect leaks and unwanted water. The detectors should be under raised floors and on dropped ceilings (to detect leaks from the floor above it). The location of the detectors should be documented and their position marked for easy access. As smoke and fire detectors should be tied to an alarm system, so should water detectors. The alarms usually just alert the necessary staff members and not everyone in the building. The staff members who are responsible for following up when an alarm sounds should be trained properly on how to reduce any potential water damage. Before any poking around to see where water is or is not pooling in places it does not belong, the electricity for that particular zone of the building should be temporarily turned off. Water detectors can help prevent damage to: • Equipment • Flooring • Walls • Computers • Facility foundations Location of water detectors should be: • Under raised floors • On dropped ceilings It is important to maintain the proper temperature and humidity levels within data centers, which is why an HVAC system should be implemented specifically for this room. Too high of a temperature can cause components to overheat and turn off; too low of a temperature can cause the components to work more slowly. If the humidity is high, then corrosion of the computer parts can take place; if humidity is low, then static electricity can be introduced. Because of this, the data center must have its own temperature and humidity controls, which are separate from the rest of the building. It is best if the data center is on a different electrical system than the rest of the building, if possible. Thus, if anything negatively affects the main building’s power, it will not carry over and affect the center. The data center may require redundant power supplies, which means two or more feeders coming in from two or more electrical substations. The idea is that if one of the power company’s substations were to go down, the company would still be able to receive electricity from the other feeder. But just because a company has two or more electrical feeders coming into its facility does not mean true redundancy is automatically in place. Many companies have paid for two feeders to come into their building, only to find out both feeders were coming from the same substation! This defeats the whole purpose of having two feeders in the first place. Data centers need to have their own backup power supplies, either an uninterrupted power supply (UPS) or generators. The different types of backup power supplies are discussed later in the chapter, but it is important to know at this point that the power backup must be able to support the load of the data center.
ch06.indd 427
10/5/2007 1:00:32 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
428 Many companies choose to use large glass panes for the walls of the data center so personnel within the center can be viewed at all times. This glass should be shatter-resistant since the window is acting as an exterior wall. The center’s doors should not be hollow, but rather secure solid-core doors. Doors should open out rather than in so they don’t damage equipment when opened. Best practices indicate that the door frame should be fixed to adjoining wall studs and that there should be at least three hinges per door. These characteristics would make the doors much more difficult to break down.
Protecting Assets The main threats that physical security components combat are theft, interruptions to services, physical damage, compromised system and environment integrity, and unauthorized access. Real loss is determined by the cost to replace the stolen items, the negative effect on productivity, the negative effect on reputation and customer confidence, fees for consultants that may need to be brought in, and the cost to restore lost data and production levels. Many times, companies just perform an inventory of their hardware and provide value estimates that are plugged into risk analysis to determine what the cost to the company would be if the equipment were stolen or destroyed. However, the information held within the equipment may be much more valuable than the equipment itself, and proper recovery mechanisms and procedures also need to be plugged into the risk assessment for a more realistic and fair assessment of cost. Laptop theft is increasing at incredible rates each year. They have been stolen for years, but in the past they were stolen mainly to sell the hardware. Now laptops are also being stolen to gain sensitive data for identity theft crimes. The CSI/FBI 2003 Computer Crime and Security Survey indicates that U.S. companies lost around $6.8 million in laptop theft. Gartner Group estimates that a stolen laptop costs a company around $6000, which does not account for any data lost or potential exposure to secondary crimes. Time magazine estimated that 1600 laptops are stolen each day in the U.S. alone. These thefts take place in airports, hotels, from cars, and within office buildings. In August 2002, close to 2000 Internal Revenue Service laptops that may have contained taxpayers’ confidential information went unaccounted for. In August 2002, five agencies under Justice Department jurisdiction reported 400 missing laptop computers. The classification level of 218 of the missing laptops was unknown, and the report noted, “It is possible that the missing laptop computers would have been used to process and store national security or sensitive law enforcement information that, if divulged, could harm the public.” In June 2004, GMAC Financial Services had two laptops stolen from an employee’s car that exposed about 200,000 of its customers’ personal data. In May 2005, MCI had a laptop stolen that contained around 16,500 current and former employees’ personal information. This list could go on and on for hundreds of pages. What is important to understand is that this is a rampant, and potentially very dangerous, crime. Many people claim, “My whole life is on my laptop” or possibly their PDA. Since employees use laptops as they travel, they may have extremely sensitive company or customer data on their systems that can easily fall into the wrong hands. The following list provides many of the protection mechanisms that can be used to protect laptops and the data they hold:
ch06.indd 428
10/5/2007 1:00:32 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
429 • Inventory all laptops, including serial numbers so they can be properly identified if recovered. • Harden the operating system. • Password protect the BIOS. • Register all laptops with the vendor and file a report when one is stolen. If a stolen laptop is sent in for repairs, it will be flagged by the vendor. • Do not check a laptop as luggage when flying. • Never leave a laptop unattended, and carry it in a nondescript carrying case. • Engrave the laptop with a symbol or number for proper identification. • Use a slot lock with a cable to connect a laptop to a stationary object. • Back up the data from the laptop and store it on a stationary PC or backup media. • Use specialized safes if storing laptops in vehicles. • Encrypt all sensitive data. Tracing software can be installed so that your laptop can “phone home” if it is taken from you. Several products offer this tracing capability. Once installed and configured, the software periodically sends in a signal to a tracking center. If you report that your laptop has been stolen, the vendor of this software will work with service providers and law enforcement to track down and return your laptop. A company may have need for a safe. Safes are commonly used to store backup data tapes, original contracts, or other types of valuables. The safe should be penetrationresistant and provide fire protection. The types of safes an organization can choose from are: • Wall safe
Embedded into the wall and easily hidden
• Floor safe Embedded into the floor and easily hidden • Chests
Stand-alone safes
• Depositories Safes with slots, which allow the valuables to be easily slipped in • Vaults Safes that are large enough to provide walk-in access If a safe has a combination lock, it should be changed periodically and only a small subset of people should have access to the combination or key. The safe should be in a visible location, so anyone who is interacting with the safe can be seen. The goal is to uncover any unauthorized access attempts. Some safes have passive or thermal relocking functionality. If the safe has a passive relocking function, it can detect when someone attempts to tamper with it, in which case extra internal bolts will fall into place to ensure it cannot be compromised. If a safe has a thermal relocking function, when a certain temperature is met (possibly from drilling), an extra lock is implemented to ensure the valuables are properly protected.
ch06.indd 429
10/5/2007 1:00:33 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
430
Internal Support Systems This place has no air conditioning or water. Who would want to break into it anyway? Having a fortified facility with secure compartmentalized areas and protected assets is nice, but having lights, air conditioning, and water within this facility is even better. Physical security needs to address these support services, because their malfunction or disruption could negatively affect the organization in many ways. Although there are many incidents of various power losses here and there for different reasons (storms, hurricanes, California running out of electricity), one of the most notable power losses took place in August 2003 when eight East Coast states and portions of Canada lost power for several days. Although there were rumors about a worm causing this disruption, it was found to be a software bug in GE Energy’s XA/21 system. This disaster left over 50 million people without power for days, caused four nuclear power plants to be shut down, and put a lot of companies in insecure and chaotic states. Security professionals need to be able to help organizations handle both the small bumps in the road, such as power surges or sags, and the gigantic sinkholes, such as what happened in the United States and Canada on August 14, 2003.
Electric Power We don’t need no stinkin’ power supply. Just rub these two sticks together. Because computing and communication has become so essential in the corporate world, power failure is a much more devastating event than it was 10 to 15 years ago. The need for good plans to fall back on is crucial to provide the assurance that a business will not be drastically affected by storms, high winds, hardware failure, lightning, or other events that can stop or disrupt power supplies. A continuous supply of electricity assures the availability of company resources; thus, a security professional must be familiar with the threats to electric power and corresponding countermeasures. Several types of power backup capabilities exist. Before a company chooses one, it should calculate the total cost of anticipated downtime and its effects. This information can be gathered from past records and other businesses in the same area on the same power grid. The total cost per hour for backup power is derived by dividing the annual expenditures by the annual standard hours of use. Large and small issues can cause power failure or fluctuations. The effects manifest in variations of voltage that can last a millisecond to days. A company can pay to have two different supplies of power to reduce its risks, but this approach can be costly. Other, less expensive mechanisms are to have generators or UPSs in place. Some generators have sensors to detect power failure and will start automatically upon failure. Depending on the type and size of the generator, it might provide power for hours or days. UPSs are usually short-term solutions compared to generators.
Power Protection Protecting power can be done in three ways: through UPSs, power line conditioners, and backup sources. UPSs use battery packs that range in size and capacity. A UPS can be online or standby. Online UPS systems use AC line voltage to charge a bank of bat-
ch06.indd 430
10/5/2007 1:00:33 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
431 teries. When in use, the UPS has an inverter that changes the DC output from the batteries into the required AC form and regulates the voltage as it powers computer devices. This conversion process is shown in Figure 6-6. Online UPS systems have the normal primary power passing through them day in and day out. They constantly provide power from their own inverters, even when the electric power is in proper use. Since the environment’s electricity passes through this type of UPS all the time, the UPS device is able to quickly detect when a power failure takes place. An online UPS can provide the necessary electricity and picks up the load after a power failure much more quickly than a standby UPS. Standby UPS devices stay inactive until a power line fails. The system has sensors that detect a power failure, and the load is switched to the battery pack. The switch to the battery pack is what causes the small delay in electricity being provided. So an online UPS picks up the load much more quickly than a standby UPS, but costs more of course. Backup power supplies are necessary when there is a power failure and the outage will last longer than a UPS can last. Backup supplies can be a redundant line from another electrical substation or from a motor generator, and can be used to supply main power or charge the batteries in a UPS system. A company should identify critical systems that need protection from interrupted power supplies, and then estimate how long secondary power would be needed and how much power is required per device. Some UPS devices provide just enough power to allow systems to shut down gracefully, whereas others allow the systems to run for a longer period. A company needs to determine whether systems should only have a big enough power supply to allow them to shut down properly or whether they need a system that keeps them up and running so critical operations remain available. Just having a generator in the closet should not give a company that warm fuzzy feeling of protection. An alternate power source should be tested periodically to make sure it works, and to the extent expected. It is never good to find yourself in an emergency only to discover the generator does not work, or someone forgot to buy the gas necessary to keep the thing running.
Figure 6-6 A UPS device converts DC current from its internal or external batteries to usable AC by using an inverter.
ch06.indd 431
10/5/2007 1:00:33 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
432 Electric Power Issues Electric power enables us to be productive and functional in many different ways, but if it is not installed, monitored, and respected properly, it can do us great harm. When clean power is being provided, the power supply contains no interference or voltage fluctuation. The possible types of interference (line noise) are electromagnetic interference (EMI) or radio frequency interference (RFI), which is disturbance to the flow of electric power while it travels across a power line, as shown in Figure 6-7. EMI can be created by the difference between three wires: hot, neutral, and ground, and the magnetic field they create. Lightning and electrical motors can induce EMI, which could then interrupt the proper flow of electrical current as it travels over wires to, from, and within buildings. RFI can be caused by anything that creates radio waves. Fluorescent lighting is one of the main causes of RFI within buildings today, so does that mean we need to rip out all the fluorescent lighting? Well, that is one choice, but we could also just use shielded cabling where fluorescent lighting could cause a problem. If you take a break from your reading, climb up into your office’s dropped ceiling, and look around, you would probably see wires bundled and tied up to the true ceiling. If your office is using fluorescent lighting, the power and data lines should not be running over, or on top of, the fluorescent lights. This is because the radio frequencies being given off can interfere with the data or power current as it travels through these wires. Now, get back down from the ceiling. We have work to do.
Figure 6-7 RFI and EMI can cause line noise on power lines.
ch06.indd 432
10/5/2007 1:00:34 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
433 Electric Power Definitions The following list summarizes many of the electric power concepts discussed so far: • Ground The pathway to the earth to enable excessive voltage to dissipate • Noise Electromagnetic or frequency interference that disrupts the power flow and can cause fluctuations • Transient noise A short duration of power line disruption • Clean power
Electrical current that does not fluctuate
• EMI
Electromagnetic interference
• RFI
Radio frequency interference
Interference interrupts the flow of an electrical current, and fluctuations can actually deliver a different level of voltage than what was expected. Each fluctuation can be damaging to devices and people. The following explains the different types of voltage fluctuations possible with electric power: • Power excess • Spike Momentary high voltage • Surge
Prolonged high voltage
• Power loss • Fault Momentary power outage • Blackout Prolonged, complete loss of electric power • Power degradation • Sag/dip Momentary low voltage condition, from one cycle to a few seconds • Brownout Prolonged power supply that is below normal voltage • In-rush current
Initial surge of current required to start a load
When an electrical device is turned on, it can draw a large amount of current, which is referred to as in-rush current. If the device sucks up enough current, it can cause a sag in the available power for surrounding devices. This could negatively affect their performance. As stated earlier, it is a good idea to have the data processing center and devices on a different electrical wiring segment from that of the rest of the facility, if possible, so the devices will not be affected by these issues. For example, if you are in a building or house without efficient wiring and you turn on a vacuum cleaner or microwave, you
ch06.indd 433
10/5/2007 1:00:34 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
434 may physically see the lights quickly dim because of this in-rush current. The drain on the power supply caused by in-rush currents still happens in other environments when these types of electrical devices are used—you just might not be able to physically see the effects. Any type of device that would cause such a dramatic in-rush current should not be used on the same electrical segment as data processing systems. Surge A surge is a prolonged rise in voltage from a power source. Surges can cause a lot of damage very quickly. A surge is one of the most common power problems and is controlled with surge protectors. These protectors use a device called a metal oxide varistor, which moves the excess voltage to ground when a surge occurs. Its source can be from a strong lightning strike, a power plant going online or offline, a shift in the commercial utility power grid, and electrical equipment within a business starting and stopping. Most computers have a built-in surge protector in their power supplies, but these are baby surge protectors and cannot provide protection against the damage that larger surges (say, from storms) can cause. So, you need to ensure all devices are properly plugged into larger surge protectors, whose only job is to absorb any extra current before it is passed to electrical devices. Blackout A blackout is when the voltage drops to zero. This can be caused by lightning, a car taking out a power line, storms, or failure to pay the power bill. It can last for seconds or days. This is when a backup power source is required for business continuity. Brownout When power companies are experiencing high demand, they frequently reduce the voltage in an electrical grid, which is referred to as a brownout. Constantvoltage transformers can be used to regulate this fluctuation of power. They can use different ranges of voltage and only release the expected 120 volts of alternating current to devices. Noise Noise on power lines can be a result of lightning, the use of fluorescent lighting, a transformer being hit by an automobile, or other environmental or human activities. Frequency ranges overlap, which can affect electrical device operations. Lightning sometimes produces voltage spikes on communications and power lines, which can destroy equipment or alter data being transmitted. When generators are switched on because power loads have increased, they too can cause voltage spikes that can be harmful and disruptive. Storms and intense cold or heat can put a heavier load on generators and cause a drop in voltage. Each of these instances is an example of how normal environmental behaviors can affect power voltage, eventually adversely affecting equipment, communications, or the transmission of data. Because these and other occurrences are common, mechanisms should be in place to detect unwanted power fluctuations and protect the integrity of your data processing environment. Voltage regulators and line conditioners can be used to ensure a clean and smooth distribution of power. The primary power runs through a regulator or conditioner. They have the capability to absorb extra current if there is a spike, and to store energy to add current to the line if there is a sag. The goal is to keep the current flowing at a nice, steady level so neither motherboard components nor employees get fried.
ch06.indd 434
10/5/2007 1:00:34 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
435 Many data centers are constructed to take power-sensitive equipment into consideration. Because surges, sags, brownouts, blackouts, and voltage spikes frequently cause data corruption, the centers are built to provide a high level of protection against these events. Other types of environments usually are not built with these things in mind and do not provide this level of protection. Offices usually have different types of devices connected and plugged into the same outlets. Outlet strips are plugged into outlet strips, which are connected to extension cords. This causes more line noise and a reduction of voltage to each device. Figure 6-8 depicts an environment that can cause line noise, voltage problems, and possibly a fire hazard.
Preventive Measures and Good Practices Don’t stand in a pool of water with a live electrical wire. Response: Hold on, I need to write that one down. When dealing with electric power issues, the following items can help protect devices and the environment: • Plug in every device to a surge protector to protect from excessive current. • Shut down devices in an orderly fashion to help avoid data loss or damage to devices due to voltage changes. • Employ power line monitors to detect frequency and voltage amplitude changes.
Figure 6-8 This configuration can cause a lot of line noise and poses a fire hazard.
ch06.indd 435
10/5/2007 1:00:35 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
436 • Use regulators to keep voltage steady and the power clean. • Protect distribution panels, master circuit breakers, and transformer cables with access controls. • Provide protection from magnetic induction through shielded lines. • Use shielded cabling for long cable runs. • Do not run data or power lines directly over fluorescent lights. • Use three-prong connections or adapters if using two-prong cables. • Do not plug outlet strips and extension cords into each other.
Environmental Issues Improper environmental controls can cause damage to services, hardware, and lives. Interruption of some services can cause unpredicted and unfortunate results. Power, heating, ventilation, air-conditioning, and air-quality controls can be complex and contain many variables. They all need to be operating properly and be monitored regularly. During facility construction, the physical security team must make certain that water, steam, and gas lines have proper shutoff valves, as shown in Figure 6-9, and positive drains, which means their contents flow out instead of in. If there is ever a break in a main water pipe, the valve to shut off water flow must be readily accessible. Similarly, in case of fire in a building, the valve to shut off the gas lines must be readily accessible. In case of a flood, a company wants to ensure that material cannot travel up through the water pipes and into its water supply or facility. Facility, operations, and security personnel should know where these shutoff valves are, and there should be strict procedures to follow in these types of emergencies. This will help reduce the potential damage. Figure 6-9 Water, steam, and gas lines should have emergency shutoff valves.
ch06.indd 436
10/5/2007 1:00:36 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
Chapter 6: Physical and Environmental Security
437 Most electronic equipment must operate in a climate-controlled atmosphere. Although it is important to keep the atmosphere at a proper working temperature, it is important to understand that the components within the equipment can suffer from overheating even in a climate-controlled atmosphere if the internal computer fans are not cleaned or are blocked. When devices are overheated, the components can expand and contract, which causes components to change their electronic characteristics, reducing their effectiveness or damaging the system overall. NOTE The climate issues involved with a data processing environment are why it needs its own separate HVAC system. Maintenance procedures should be documented and properly followed. HVAC activities should be recorded and reviewed annually. Maintaining appropriate temperature and humidity is important in any facility, especially facilities with computer systems. Improper levels of either can cause damage to computers and electrical devices. High humidity can cause corrosion, and low humidity can cause excessive static electricity. This static electricity can short out devices, cause the loss of information, or provide amusing entertainment for unsuspecting employees. Lower temperatures can cause mechanisms to slow or stop, and higher temperatures can cause devices to use too much fan power and eventually shut down. Table 6-1 lists different components and their corresponding damaging temperature levels. In drier climates, or during the winter, the air contains less moisture, which can cause static electricity when two dissimilar objects touch each other. This electricity usually travels through the body and produces a spark from a person’s finger that can release several thousand volts. This can be more damaging than you would think. Usually the charge is released on a system casing and is of no concern, but sometimes it is released directly to an internal computer component and causes damage. People who work on the internal parts of a computer usually wear antistatic armbands to reduce the chance of this happening. In more humid climates, or during the summer, more humidity is in the air, which can also affect components. Particles of silver can begin to move away from connectors onto copper circuits, which cement the connectors into their sockets. This can adversely affect the electrical efficiency of the connection. A hygrometer is usually used to monitor humidity. It can be manually read, or an automatic alarm can be set up to go off if the humidity passes a set threshold.
Preventive Steps Against Static Electricity The following are some simple measures to prevent static electricity: • Use antistatic flooring in data processing areas. • Ensure proper humidity. • Have proper grounding for wiring and outlets. • Don’t have carpeting in data centers, or have static-free carpets if necessary. • Wear antistatic bands when working inside computer systems.
ch06.indd 437
10/5/2007 1:00:36 PM
All-in-1 / CISSP All-in-One Exam Guide, Fourth Edition / Harris / 787-0
CISSP All-in-One Exam Guide
438 Table 6-1 Components Affected by Specific Temperatures
Material or Component
Damaging Temperature
Computer systems and peripheral devices
175°F
Magnetic storage devices
100°F
Paper products
350°F
Ventilation Can I smoke in the server room? Response: Security! Air ventilation has several requirements that mus
